LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

CRITICAL 9.8CVE-2026-37004 · GHSA-6wvf-77m9-58rm · PYSEC-2026-3861 · Published 27/08/2026 · updated 01/09/2026

Package	Affected versions	Patched versions
litellm PyPI	`< 1.83.7`	`1.83.7`

Description

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-37004 · ADVISORY
BerriAI/litellm commit d910a95 · WEB
BerriAI/litellm · PACKAGE
BerriAI/litellm · WEB
BerriAI/litellm release v1.83.7-stable · WEB
yerangamage.com/cves/detail · WEB
pypi.org/project/litellm · PACKAGE
GitHub Advisory GHSA-6wvf-77m9-58rm · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free