LiteLLM: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-37004
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 27, 2026
- Source last modified
- September 8, 2026
Description
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
Description quoted from the NVD record.
Who is affected
This flaw affects LiteLLM, made by BerriAI, a service that sits between your organization's apps and AI language model providers and passes requests between them. It affects LiteLLM version 1.82.4 and earlier. The problem is in the part of the product used to test prompts (the instructions sent to an AI model). An attacker on the network, without logging in, could send a specially made request to that part and run any commands they choose on the computer where LiteLLM runs. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs LiteLLM, ask them to check which version is in use. Any version up to and including
1.82.4is affected. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs LiteLLM for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 8, 2026 and reviewed before publishing.