Advisoriesby IbisLiteLLMGHSA-6wvf-77m9-58rm
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Fix: upgrade to 1.83.7 or later
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.83.7 | 1.83.7 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1336
- Also known as
- CVE-2026-37004, PYSEC-2026-3861
- nvd.nist.gov/vuln/detail/CVE-2026-37004
- github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c
- github.com/BerriAI/litellm
- github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073
- github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- yerangamage.com/cves/detail/?slug=litellm-ssti-rce
More LiteLLM advisories
All LiteLLM
LiteLLM: server-side request forgeryCVE-2026-84377fixed in 1.88.6 +8LiteLLM Proxy has server-side request forgery via the `user_config` request parameterCVE-2026-59823fixed in 1.83.9LiteLLM: Custom Code Guardrails production endpoints bypass code safety checksCVE-2026-59821fixed in 1.82.0LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackCVE-2026-59822fixed in 1.84.0LiteLLM: Local file read via request-supplied OIDC file referencesCVE-2026-59819fixed in 1.83.10LiteLLM: Arbitrary file write via path traversal in Skills archive extractionCVE-2026-59820fixed in 1.83.7