Vulnerability record · CVE-2024-2952 · published 10 April 2024

CVE-2024-2952: Litellm vulnerability

Litellm · Litellm

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.

9.8 CVSS 3.0 Critical EPSS 1.3% · top 31.4% CWE-76 · CWE-76

9.8CVSS 3.0 base score

1.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Litellm Litellm

References

Link	Tags
https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3	Patch
https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4	ExploitThird Party Advisory
https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3	Patch
https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4	ExploitThird Party Advisory

Track CVE-2024-2952 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-33634Trivy and trivy-action supply chain compromise via malicious release and tagsA threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-acti…KEVEPSS 1.7%analysed23 Mar 2026 9.3CVE-2026-42208LiteLLM proxy SQL injection in API key checkLiteLLM versions 1.81.16 to before 1.83.7 build a database query for proxy API key checks by concatenating the caller-supplied key into the query tex…KEVEPSS 5.8%analysed8 May 2026 8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8 Jul 2026 8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed8 May 2026 9.8CVE-2024-5751Litellm code injection vulnerabilityBerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_de…EPSS 0.88%27 Jun 2024 9.5CVE-2026-49468Litellm authentication bypass by spoofing vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM prox…EPSS 0.82%22 Jun 2026 9.4CVE-2026-35030Litellm improper authentication vulnerabilityLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt…EPSS 0.88%6 Apr 2026 8.8CVE-2026-40217Litellm code injection vulnerabilityLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.EPSS 3.4%10 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2024-2952), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.