CVE-2024-2952

Published: Apr 10, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@huntr.dev (Secondary)

Description

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.

Affected (1)

Products: Litellm: Litellm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Litellm Litellm	Before 1.34.42

Related CWEs

Improper Neutralization of Equivalent Special Elements

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

References (4)

https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3

Source: security@huntr.dev

Patch

https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4

Source: security@huntr.dev

ExploitThird Party Advisory

https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.