CVE-2024-2952 Server-Side Template Injection in BerriAI/litellm

What is CVE-2024-2952?

CVE-2024-2952 is a critical code injection vulnerability in berriai/litellm, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.

Weakness: CWE-76

Which versions are affected by CVE-2024-2952?

3 open source packages ship an affected version, including litellm. It affects 1 product.

Products include Litellm Litellm.

How do I fix CVE-2024-2952?

Upgrade litellm to 1.34.42 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-2952 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2952 exists.

Other vulnerabilities in berriai/litellm

• CVE-2026-42208 BerriAI LiteLLM SQL Injection Exploited Critical 9.3
• CVE-2026-59822 BerriAI LiteLLM Improper Authentication Exploited High 8.8
• CVE-2026-42271 BerriAI LiteLLM Command Injection Exploited High 8.7
• CVE-2024-5751 Remote Code Execution in BerriAI/litellm Critical 9.8
• CVE-2026-49468 LiteLLM: Authentication Bypass via Host Header Injection Critical 9.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-46cm-pfwv-cgf8, PYSEC-2026-387.