CVE-2024-2952

The `hf_chat_template` method processes the `chat_template` parameter read from the `tokenizer_config.json` file directly through the Jinja2 template engine without proper input sanitization. An attacker can craft a malicious `tokenizer_config.json` file containing Jinja2 template directives that will be executed on the server side. The absence of any authentication requirements (PR:N, UI:N) makes the exploit remotely executable over the network without user interaction.

Successful exploitation enables an attacker to achieve complete remote code execution (RCE) on the server, which may lead to full control over the host, data theft, and compromise of the confidentiality and integrity of the environment.

BerriAI LiteLLM should be updated to a version containing commit 8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3 or newer, available in the BerriAI project GitHub repository. Until the patch is deployed, it is recommended to restrict network access to the `/completions` endpoint and implement strict controls over the sources of `tokenizer_config.json` files processed by the service.

BerriAI LiteLLM product — versions specified in producer references (patched commit: 8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3).