PT-2026-53472 · Pypi · Litellm

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf chat template method processing the chat template parameter from the tokenizer config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer config.json files that execute arbitrary code on the server.

Correção

Identificadores relacionados

PYSEC-2026-387

Produtos afetados

Litellm

Referências · 10

• https://github.com/BerriAI/litellm/pull/2941 · Nota
• https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087 · Nota
• https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3 · Nota
• https://github.com/BerriAI/litellm/issues/2949 · Nota
• https://github.com/BerriAI/litellm · Nota
• https://osv.dev/vulnerability/PYSEC-2026-387 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-2952 · Nota de Segurança
• https://pypi.org/project/litellm · Nota
• https://github.com/advisories/GHSA-46cm-pfwv-cgf8 · Nota
• https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4 · Nota