{"action":"Upgrade litellm to 1.34.42 or later.","affected":[{"fixed":"1.34.42","introduced":"0"}],"component":"litellm","cve_ids":["CVE-2024-2952"],"ecosystem":"PyPI","epss":0.01267,"exploited":false,"fixed_versions":["1.34.42"],"ghsa_id":"GHSA-46cm-pfwv-cgf8","id":"tcs_01M5KEXC9630C41G8X3D1Q88GY","modified_at":"2026-09-10T03:50:11.252627712Z","published_at":"2024-04-10T18:30:48Z","references":["https://osv.dev/vulnerability/GHSA-46cm-pfwv-cgf8","https://nvd.nist.gov/vuln/detail/CVE-2024-2952","https://github.com/BerriAI/litellm/issues/2949","https://github.com/BerriAI/litellm/pull/2941","https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3","https://github.com/BerriAI/litellm","https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087","https://github.com/advisories/GHSA-46cm-pfwv-cgf8","https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-387.yaml","https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4","https://pypi.org/project/litellm"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-46cm-pfwv-cgf8","url":"https://osv.dev/vulnerability/GHSA-46cm-pfwv-cgf8"}],"summary":"LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint"}