{"action":"Upgrade litellm to 1.34.42 or later.","affected":[{"fixed":"1.34.42","introduced":"0"}],"component":"litellm","cve_ids":["CVE-2024-2952"],"ecosystem":"PyPI","epss":0.01267,"exploited":false,"fixed_versions":["1.34.42"],"ghsa_id":"GHSA-46cm-pfwv-cgf8","id":"tcs_01M5KH89BZ0Y7B0V8VKYGKBP02","modified_at":"2026-07-01T20:22:56.238364Z","published_at":"2026-06-29T11:50:39.562812Z","references":["https://osv.dev/vulnerability/PYSEC-2026-387","https://nvd.nist.gov/vuln/detail/CVE-2024-2952","https://github.com/BerriAI/litellm/issues/2949","https://github.com/BerriAI/litellm/pull/2941","https://github.com/BerriAI/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3","https://github.com/BerriAI/litellm","https://github.com/BerriAI/litellm/blob/0d803e13798db40aa7463e64a6bafaee386424f5/litellm/proxy/proxy_server.py#L2087","https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4","https://pypi.org/project/litellm","https://github.com/advisories/GHSA-46cm-pfwv-cgf8"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-387","url":"https://osv.dev/vulnerability/PYSEC-2026-387"}],"summary":"LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint"}