Skip to content
Log inStart free trial

GHSA-46cm-pfwv-cgf8 CVE-2024-2952 PYSEC-2026-387

LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

Critical PyPI
Severity
9.8 / 10
Critical · CVSS 3.0
Exploit chance (EPSS)
1.27%
Chance of exploitation in the next 30 days. Higher than 69.76% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-76 Improper Neutralization of Equivalent Special Elements
Fix
1.34.42
Upgrade litellm to this version or later

Description

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf_chat_template method processing the chat_template parameter from the tokenizer_config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer_config.json files that execute arbitrary code on the server.

Affected versions

PyPI

PackageVulnerableFixed in
litellm
< 1.34.42
1.34.42
litellm
< 1.34.42
1.34.42

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

litellm PyPI → 1.34.42

pip
pip install --upgrade "litellm>=1.34.42"
poetry
poetry add "litellm>=1.34.42"
uv
uv add "litellm>=1.34.42"

Severity breakdown

CVSS 3.0 9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-76: Improper Neutralization of Equivalent Special Elements

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

How to prevent it
  • Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7488-6r32-c95q
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
High Known exploited Also affects litellm
GHSA-v4p8-mg3p-g94g
LiteLLM: Authenticated command execution via MCP stdio test endpoints
High Known exploited Also affects litellm
GHSA-r75f-5x8p-qvmc
LiteLLM has SQL Injection in Proxy API key verification
Critical Known exploited Also affects litellm
GHSA-g5ff-637f-6q2m
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
High Also affects litellm
GHSA-hhww-mrg2-969h
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Medium Also affects litellm
GHSA-7hp6-4w63-5g45
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
Critical Also affects litellm
GHSA-hx8v-g79f-8w5f
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Medium Also affects litellm
GHSA-3cv6-jpf6-8222
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Medium Also affects litellm
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor