CVE-2024-2952Critical· 9.8▾ MidnightLiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.3%
1.3% → 1.3%
Last analysed / modified upstream
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf_chat_template method processing the chat_template parameter from the tokenizer_config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer_config.json files that execute arbitrary code on the server.
litellm < 1.34.42Upgrade to a patched release:
litellm 1.34.42Connected by shared product, vendor, weakness, or advisory.
CVE-2026-37004Critical· 9.8LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
CVE-2026-49468Critical· 9.8LiteLLM: Authentication Bypass via Host Header Injection
CVE-2026-59823Medium· 5.3LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-12796Medium· 6.3BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
CVE-2026-12797Medium· 6.3BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints