LiteLLMGHSA-6wvf-77m9-58rm
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Critical9.8CVE-2026-37004 · Published Aug 27, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.83.7 | 1.83.7 |
Details and references
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1336
- Also known as
- CVE-2026-37004, PYSEC-2026-3861
- nvd.nist.gov/vuln/detail/CVE-2026-37004
- github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c
- github.com/BerriAI/litellm
- github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073
- github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- yerangamage.com/cves/detail/?slug=litellm-ssti-rce
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 17 | LiteLLM Proxy has server-side request forgery via the `user_config` request parameter CVE-2026-59823Mediumfixed in 1.83.9 | Medium | 1.83.9 |
| Jul 22 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks CVE-2026-59821Lowfixed in 1.82.0 | Low | 1.82.0 |
| Jul 22 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822Highfixed in 1.84.0 | High | 1.84.0 |
| Jul 22 | LiteLLM: Local file read via request-supplied OIDC file references CVE-2026-59819Lowfixed in 1.83.10 | Low | 1.83.10 |
| Jul 22 | LiteLLM: Arbitrary file write via path traversal in Skills archive extraction CVE-2026-59820Mediumfixed in 1.83.7 | Medium | 1.83.7 |
| Jun 21 | BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader CVE-2026-12798Low6.3no fix yet | Low6.3 | No fix yet |