https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:32:55 +0000 https://vulnerability.circl.lu/vuln/cve-2024-6825 <p><strong>Affected:</strong> berriai/litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> <p><strong>Affected:</strong> berriai/litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> https://vulnerability.circl.lu/vuln/cve-2024-6825 https://vulnerability.circl.lu/vuln/ghsa-53gh-p8jc-7rg8 <p><strong>Affected:</strong> PyPI: litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> <p><strong>Affected:</strong> PyPI: litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> https://vulnerability.circl.lu/vuln/ghsa-53gh-p8jc-7rg8 https://vulnerability.circl.lu/vuln/pysec-2026-1541 <p><strong>Affected:</strong> PyPI: litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> <p><strong>Affected:</strong> PyPI: litellm</p> <p>BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the &#39;post_call_rules&#39; configuration, where a callback function can be added. The provided value is split at the final &#39;.&#39; mark, with the last part considered the function name and the remaining part appended with the &#39;.py&#39; extension and imported. This allows an attacker to set a system method, such as &#39;os.system&#39;, as a callback, enabling the execution of arbitrary commands when a chat response is processed.</p> https://vulnerability.circl.lu/vuln/pysec-2026-1541