-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the removed eval() call in get_secret() shown in the diff. This function processed attacker-controlled encrypted_secret values from the /config/update endpoint via add_deployment. The eval() on encrypted_secret.encode() enabled RCE by allowing execution of arbitrary Python code in the payload. The patch replaced this dangerous eval() with a safety check, confirming this was the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| litellm | pip | < 1.40.16 | 1.40.16 |