CVE-2024-2952

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the "/completions" endpoint. The vulnerability arises from the "hfchattemplate" method processing the "chattemplate" parameter from the "tokenizerconfig.json" file through the Jinja template engine without proper sanitizatio...

CVE-2024-2952: Improper Neutralization of Equivalent Special Elements

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization...