9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
9.1%
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions
endpoint. The vulnerability arises from the hf_chat_template
method processing the chat_template
parameter from the tokenizer_config.json
file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizer_config.json
files that execute arbitrary code on the server.