How severe is CVE-2024-2952?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2024-2952?

This is classified as CWE-76, which is a common weakness in software security.

CVE-2024-2952 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.

Related Vulnerabilities

CVE-2024-34359

CRITICAL

CVSS:9.6(Critical)

llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructo...

CWE-762024

CVE-2023-0493

HIGH

CVSS:8.8(High)

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

CWE-762023

CVE-2024-4897

HIGH

CVSS:8.4(High)

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_3...

CWE-762024