CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

The /prompts/test endpoint renders a prompt template that the caller supplies in dotprompt_content. The proxy rendered it with a plain jinja2.Environment, which has no sandbox. A Jinja expression can walk Python object attributes (for example through __class__ and __mro__) and reach functions that start processes. The result is arbitrary command execution as the user running the LiteLLM proxy.

The advisory says the attacker needs no account and no user interaction, only network access to the proxy. A LiteLLM proxy usually holds the upstream provider API keys, the master key and the database connection string. Code execution on it exposes all of them, and lets the attacker read or alter every prompt and response that passes through. An internet-exposed proxy is the worst case. Teams that run it behind an internal network are exposed to anyone who can reach it from there.

The litellm pip package is affected in versions below 1.83.7. The advisory text names <=1.82.4, but the package data lists everything below 1.83.7, so treat any older release as vulnerable. Only deployments that run the proxy server and expose /prompts/test matter in practice.

Check the installed version:

pip show litellm

If you run the proxy from a container image, check the version the image ships.

Upgrade to 1.83.7:

pip install --upgrade "litellm>=1.83.7"

The fix commit switches the prompt manager to Jinja's ImmutableSandboxedEnvironment, with a code comment that templates can arrive from user input through /prompts/test. The same commit also restricts setting allowed_routes on a key to proxy admins and validates logo_url and favicon_url values. The advisory lists no workaround. Until you upgrade, block access to /prompts/test at your reverse proxy or firewall, and rotate provider keys and the master key if the proxy was reachable by untrusted clients.

Look in your proxy access logs for requests to /prompts/test, especially POST bodies whose dotprompt_content contains Jinja syntax such as {{, {%, __class__, __mro__, __subclasses__ or os.popen. Legitimate use of this endpoint is rare, so any request from an unexpected source is worth checking.

On the host, look for child processes of the LiteLLM server (shells, curl, wget), new outbound connections, and unexpected files in the working directory. If you suspect a hit, treat every secret in the proxy environment as exposed.

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.