| Component | LiteLLM |
| Severity | critical (CVSS 9.8) |
| CVSS vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published (NVD) | 2024-04-10 |
| Last modified | 2026-06-17 |
| Affected versions | < 1.34.42 |
| Fixed in | 1.34.42 |
| Weakness | CWE-76 |
| CISA KEV | not listed |
NVD description
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf_chat_template method processing the chat_template parameter from the tokenizer_config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer_config.json files that execute arbitrary code on the server.
What to do
- Upgrade LiteLLM to
1.34.42or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2024-2952
- https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
- https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4