# CVE-2024-2952: BerriAI LiteLLM SSTI in completions endpoint

Source: https://junglewise.ai/threats/cve-2024-2952-berriai-litellm-ssti-in-completions-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-10. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2024-2952 · Severity: critical · CVSS 9.8 · Published 2024-04-10

LiteLLM, a tool used to connect various AI models to applications, contains a critical security flaw in its completions interface. An attacker can exploit this by providing a specially crafted configuration file that allows them to execute unauthorized commands on the server. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of AI services.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-2952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-2952 being exploited in the wild.

**How severe is CVE-2024-2952?** Critical severity, with a CVSS score of 9.8, published 10 April 2024.

**Which products and versions are affected?** Berriai LiteLLM < 1.34.42; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.34.42.

**Is there a fix for CVE-2024-2952?** Yes. litellm (PyPI): upgrade to 1.34.42 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-2952 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-2952?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.34.42 or later

  ```sh
  pip install "litellm>=1.34.42"
  ```


## Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in LiteLLM's `/completions` endpoint. The flaw is located in the `hf_chat_template` method, which processes the `chat_template` parameter from `tokenizer_config.json` files using the Jinja2 template engine without adequate sanitization. A remote, unauthenticated attacker can exploit this by supplying a malicious configuration file, leading to arbitrary code execution on the host server. The issue is addressed in version 1.34.42.

## Affected products

- BerriAI litellm < 1.34.42

## Identifiers

- CVE-2024-2952
- GHSA-46cm-pfwv-cgf8
- PYSEC-2026-387

## Timeline

- 2024-04-10: advisory
- 2024-04-10: disclosed
- 2024-04-10: patched

## References

- [https://api.github.com/users/ishaan-jaff](https://api.github.com/users/ishaan-jaff)
- [https://github.com/ishaan-jaff](https://github.com/ishaan-jaff)
- [https://api.github.com/users/ishaan-jaff/gists%7B/gist_id%7D](https://api.github.com/users/ishaan-jaff/gists%7B/gist_id%7D)
- [https://api.github.com/users/ishaan-jaff/repos](https://api.github.com/users/ishaan-jaff/repos)
- [https://avatars.githubusercontent.com/u/29436595?v=4](https://avatars.githubusercontent.com/u/29436595?v=4)
- [https://api.github.com/users/ishaan-jaff/events%7B/privacy%7D](https://api.github.com/users/ishaan-jaff/events%7B/privacy%7D)

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [LiteLLM proxy authentication bypass via reused crypto context](https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)