CVE-2024-4889 is a high severity code injection in BerriAI LiteLLM, version 1.34.6, scored 7.2. Unvalidated input reaches eval in the secret management code, but only when a Google KMS configuration is in use. The record names no fixed release, so check the project.
What's affected
The record names LiteLLM 1.34.6 (berriai/litellm). The flaw is in the secret management system, where unvalidated input is passed to the eval function. The record says exploitation depends on a valid Google KMS configuration file, and that the issue is "contingent upon the use of the Google KMS feature".
The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The privilege requirement is high, which fits the description: the attacker has to influence a logo path setting and an environment variable. Those are administrator level controls in most deployments, so this is closer to an admin to host escalation than a drive by flaw.
Fixed version: the single reference is a huntr bounty page that I could not read, so I cannot name a patched release. Look in LiteLLM's release notes for a change to the KMS and logo handling.
The weakness is CWE-94, improper control of code generation.
How to check if you're exposed
Find LiteLLM versions with pip show litellm or the container image tag. Version 1.34.6 is the one named.
Then decide whether the condition applies. Look for Google KMS use in your proxy configuration and environment, and check who can set environment variables or UI settings for the proxy, including a custom logo location. If KMS is not configured and nobody untrusted can change settings, the practical risk is low, but you should still upgrade.
What to do now
- Inventory LiteLLM installs and note which use Google KMS.
- Upgrade to a release that the maintainers confirm addresses this, after reading the notes.
- Restrict who can change proxy settings and environment variables, and keep admin keys scarce.
- Do not allow the proxy to fetch images or files from arbitrary remote addresses for branding; pin it to local, reviewed assets.
- Review the proxy host for unexpected configuration files.
Why it matters
Calling eval on data that can be influenced from outside is a standing hazard: whatever the string contains gets run as code by the host process. Secret handling code runs with access to the very credentials an attacker wants, which makes a mistake there costly.
The prerequisites in this case limit the reach. The attacker needs high privileges and a specific feature turned on. Even so, defenders should read the chain as a reminder that configuration inputs, such as file paths and URLs for a logo, are also input and deserve validation.
The record does not mark this CVE as exploited in the wild and it is not in the CISA KEV catalog.
Quick check
Am I safe if I do not use Google KMS?
The record says exploitation is contingent on the Google KMS feature. That lowers risk, but upgrading is still sensible.
Why is the privilege level high?
The attacker must control settings that are normally administrator only, according to the vector and the description.
Sources
- huntr bounty report (page content could not be retrieved)
- NVD record for CVE-2024-4889
Last reviewed: 19 October 2026.
