LiteLLM: Server-Side Template Injection in /prompts/test endpoint
HighCVE-2026-42203 · Published Apr 24, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | >= 1.80.5, < 1.83.7 | 1.83.7 |
Details and references
### Impact The `POST /prompts/test` endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. Proxy deployments running an affected version are in scope. ### Patches The issue is fixed in **`1.83.7-stable`**. The fix switches the prompt template renderer to a sandboxed environment that blocks the attributes this attack relies on. LiteLLM recommends upgrading to `1.83.7-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Block `POST /prompts/test` at your reverse proxy or API gateway. 2. Review and rotate API keys that should not have access to prompt management routes.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1336
- Also known as
- CVE-2026-42203, PYSEC-2026-2602
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 24 | LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208Critical9.8fixed in 1.83.7 | Critical9.8 | 1.83.7 |
| Apr 25 | LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271High8.8fixed in 1.83.7 | High8.8 | 1.83.7 |
| Apr 8 | LiteLLM: Password hash exposure and pass-the-hash authentication bypass GHSA-69x8-hrgq-fjj8Highfixed in 1.83.0 | High | 1.83.0 |
| May 11 | LiteLLM has a sandbox escape in custom-code guardrail CVE-2026-40217High8.8fixed in 1.83.10 | High8.8 | 1.83.10 |
| Apr 3 | LiteLLM: Authentication bypass via OIDC userinfo cache key collision CVE-2026-35030Criticalfixed in 1.83.0 | Critical | 1.83.0 |
| Apr 3 | LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35029Highfixed in 1.83.0 | High | 1.83.0 |