gcdRadar
archive/Patch now/AIR-2024-0086
closedclosed 10 Apr 2024Patch now2 Disclosed vulnerabilityAI

LiteLLM Server-Side Template Injection in Completions Endpoint

LiteLLM

LiteLLM is vulnerable to server-side template injection via the /completions endpoint through improper processing of tokenizer configurations. Attackers can exploit this via malicious configuration files to run arbitrary code.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
9.8
EPSS
0.01 · top 30% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
10 Apr 2024
last update
10 Apr 2024
CVE ids
CVE-2024-2952other records

Timeline · 1

  1. 10 Apr 2024CVE-2024-2952: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

Sources · 1

Advisories and databases

  1. 2024-04-10
    CVE-2024-2952: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
    GitHub Advisory Database · github.com/advisories/GHSA-46cm-pfwv-cgf8

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerability
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
no technique for these categories
tags
sstilitellm
dates
happened 10 Apr 2024 · first reported 10 Apr 2024
origin
GitHub Advisory Database
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 07:00Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# LiteLLM Server-Side Template Injection in Completions Endpoint

https://gcdradar.vercel.app/incidents/litellm-server-side-template-injection-in-completions-endpoi · AIR-2024-0086 · closed 2024-04-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-04-10
- AI role: Attack on AI
- Products: LiteLLM
- CVE ids: CVE-2024-2952
- CVSS: 9.8

## Summary

LiteLLM is vulnerable to server-side template injection via the /completions endpoint through improper processing of tokenizer configurations. Attackers can exploit this via malicious configuration files to run arbitrary code.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-04-10: CVE-2024-2952: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint (https://github.com/advisories/GHSA-46cm-pfwv-cgf8)

## Sources

- 2024-04-10 GitHub Advisory Database: CVE-2024-2952: LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint https://github.com/advisories/GHSA-46cm-pfwv-cgf8

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed8.7
    LiteLLM CVE-2024-6587: LiteLLM Server-Side Request Forgery vulnerability

    Patch now · Disclosed · since 13 Sep 2024 · CVE-2024-6587

    AI
  2. closed4.9
    LiteLLM CVE-2024-4890: SQL Injection Vulnerability in LiteLLM

    Patch now · Disclosed · since 6 Jun 2024 · CVE-2024-4890

    AI
  3. closed7.2
    LiteLLM CVE-2024-4264: LiteLLM Unsafe Eval Remote Code Execution

    Patch now · Disclosed · since 18 May 2024 · CVE-2024-4264

    AI
  4. closed3.5
    LiteLLM CVE-2025-11203: LiteLLM information disclosure vulnerability in health endpoint

    Patch now · Disclosed · since 29 Oct 2025 · CVE-2025-11203

    AI
  5. closed5.4
    LiteLLM CVE-2025-45809: SQL injection vulnerability in BerriAI LiteLLM

    Patch now · Disclosed · since 3 Jul 2025 · CVE-2025-45809

    AI
  6. closed7.5
    LiteLLM CVE-2024-10188: LiteLLM Vulnerable to Denial of Service

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10188

    AI