PT-2026-53472 · Pypi · Litellm

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hf chat template method processing the chat template parameter from the tokenizer config.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer config.json files that execute arbitrary code on the server.

Fix

Related Identifiers

PYSEC-2026-387

Affected Products

Litellm

References · 10

• https://osv.dev/vulnerability/PYSEC-2026-387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2952 · Security Note
• https://github.com/BerriAI/litellm/pull/2941 · Note
• https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087 · Note
• https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3 · Note
• https://github.com/BerriAI/litellm/issues/2949 · Note
• https://github.com/BerriAI/litellm · Note
• https://pypi.org/project/litellm · Note
• https://github.com/advisories/GHSA-46cm-pfwv-cgf8 · Note
• https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4 · Note