CVE-2024-2952: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizerconfig.json files that execute arbitrary code on the server.
Published Apr 10, 2024 · Updated Jul 6, 2026
Affected packages
litellm
- Ecosystem
- PyPI
- Affected
- < 1.34.42
- Fixed in
- 1.34.42
- Check
pip show litellm
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf_chat_template method processing the chat_template parameter from the tokenizer_config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer_config.json files that execute arbitrary code on the server.
Credited to ishaan-jaff, r3kumar, cookesan.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-2952
- https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
- https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087
- https://github.com/BerriAI/litellm/issues/2949
- https://github.com/BerriAI/litellm/pull/2941
- https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
- https://github.com/BerriAI/litellm
- https://github.com/advisories/GHSA-46cm-pfwv-cgf8
- https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-387.yaml
- https://pypi.org/project/litellm
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More LiteLLM vulnerabilities
All LiteLLM entriesCVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
medium6.5Sep 30, 2026CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
medium5.3Sep 17, 2026CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
critical9.8Aug 27, 2026CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
low2.1Jul 22, 2026CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
medium6.1Jul 22, 2026CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
low2.1Jul 22, 2026