PT-2026-53474 · Pypi · Litellm

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the add deployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the get secret function is triggered. This requires the server to use Google KMS and a database to store a model.

Fix

Related Identifiers

PYSEC-2026-389

Affected Products

Litellm

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-5751 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-389 · Vendor Advisory
• https://github.com/BerriAI/litellm/pull/4228 · Note
• https://github.com/berriai/litellm · Note
• https://github.com/BerriAI/litellm/commit/fcea4c22ad96b24436f196ae709f71932e84b0b8 · Note
• https://pypi.org/project/litellm · Note
• https://github.com/advisories/GHSA-gppg-gqw8-wh9g · Note
• https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce · Note