-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| litellm | pip | <= 1.28.11 |
Miggo AIRoot Cause AnalysisThe vulnerability specifically cites improper use of eval() in litellm.get_secret() when handling Google KMS secrets. The linked utils.py code (lines 9867-9885) contains the secret handling logic. Since environment variables controlled via the /config/update endpoint are passed directly to eval() without validation, this function is the clear injection point. The other referenced proxy_server.py endpoints handle the config updates but the actual vulnerable code path is in the eval() usage within get_secret().