Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

LiteLLM can run remote commands via prompts test

CVE-2026-37004 · published 1 month ago
Summary

The LiteLLM software (versions up to 1.82.4) lets anyone on the internet send specially crafted data to the /prompts/test page and cause the server to run any command it wants. This could let attackers take control of the server or steal data. Upgrade to a newer version of LiteLLM or apply the vendor's patch, and limit access to the endpoint to trusted users only.

What to do
  • Update litellm to version 1.83.7.
Affected software
Ecosystem VendorProductAffected versions
pip – litellm < 1.83.7
Fix: upgrade to 1.83.7
Original advisory text
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published27 Aug 2026
Updated7 Oct 2026
First seen27 Aug 2026
Sources
CVE-2026-37004 · NVD
CVE-2026-37004 · MITRE
GHSA-6wvf-77m9-58rm · GHSA
PYSEC-2026-3861 · OSV
Track software like this
Free during beta