Junglewise Threat Intelligence

CVE-2026-37004: BerriAI LiteLLM server-side template injection in prompts endpoint

CVE-2026-37004 · Severity: critical · CVSS 9.8 · Published 2026-08-27

Executive brief

LiteLLM is a popular library that manages interfaces to multiple large language models. The `/prompts/test` endpoint in versions up to 1.82.4 contains a critical flaw that allows unauthenticated attackers to inject arbitrary code through a template parameter. An attacker can exploit this to execute arbitrary commands on the server, gaining full control over the system and potentially accessing sensitive data or causing service outages.

Technical details

The vulnerability exists in the prompt endpoints component (litellm/proxy/prompts/prompt_endpoints.py) where user-supplied template content is processed through an unsandboxed jinja2.Environment object. The `/prompts/test` endpoint accepts a `dotprompt_content` parameter that is directly rendered as a Jinja2 template without proper input sanitization or sandboxing. This allows attackers to inject Jinja2 template directives that can access Python's built-in functions and object attributes to execute arbitrary OS commands. The root cause is the use of the standard `Environment` class instead of Jinja2's sandboxed variant. The fix, merged in commit d910a95, replaces the unsandboxed `Environment` with `ImmutableSandboxedEnvironment` from `jinja2.sandbox`, which restricts access to dangerous attributes and functions. Patched version 1.83.7 and later are not affected.

Affected products

  • BerriAI LiteLLM < 1.83.7

Timeline

  • 2026-08-27: disclosed
  • 2026-08-27: advisory
  • 2026-04-09: patched: Fix committed on April 9, 2026; patched version 1.83.7 released April 19, 2026

References

Related threats