Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dzdw-y87c-9fh7
Vulnerability ID VCID-dzdw-y87c-9fh7
Aliases CVE-2024-2952
GHSA-46cm-pfwv-cgf8
Summary BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-76 Improper Neutralization of Equivalent Special Elements
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01434 https://api.first.org/data/v1/epss?cve=CVE-2024-2952
epss 0.01434 https://api.first.org/data/v1/epss?cve=CVE-2024-2952
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-46cm-pfwv-cgf8
cvssv3.1 9.8 https://github.com/BerriAI/litellm
generic_textual CRITICAL https://github.com/BerriAI/litellm
cvssv3.1 9.8 https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087
generic_textual CRITICAL https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087
cvssv3 9.8 https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
ssvc Track* https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
cvssv3.1 9.8 https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
generic_textual CRITICAL https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
cvssv3.1 9.8 https://github.com/BerriAI/litellm/issues/2949
generic_textual CRITICAL https://github.com/BerriAI/litellm/issues/2949
cvssv3.1 9.8 https://github.com/BerriAI/litellm/pull/2941
generic_textual CRITICAL https://github.com/BerriAI/litellm/pull/2941
cvssv3 9.8 https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
cvssv3.1 9.8 https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
generic_textual CRITICAL https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
ssvc Track* https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2024-2952
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-2952
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-2952
https://github.com/BerriAI/litellm
https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087
https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
https://github.com/BerriAI/litellm/issues/2949
https://github.com/BerriAI/litellm/pull/2941
8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3 https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
a9e0a164-6de0-43a4-a640-0cbfb54220a4 https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
CVE-2024-2952 https://nvd.nist.gov/vuln/detail/CVE-2024-2952
GHSA-46cm-pfwv-cgf8 https://github.com/advisories/GHSA-46cm-pfwv-cgf8
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/BerriAI/litellm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-07-03T15:32:17Z/ Found at https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/BerriAI/litellm/issues/2949
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/BerriAI/litellm/pull/2941
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-07-03T15:32:17Z/ Found at https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-2952
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.81109
EPSS Score 0.01434
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:48:28.650741+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/2xxx/CVE-2024-2952.json 38.6.0