| Package | Affected versions | Patched versions |
|---|---|---|
| litellm | < 1.83.7 | 1.83.7 |
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free