Is CVE-2026-37004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37004 being exploited in the wild.

How severe is CVE-2026-37004?

Critical severity, with a CVSS score of 9.8, published 27 August 2026.

Which products and versions are affected?

Berriai LiteLLM < 1.83.7; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.7.

Is there a fix for CVE-2026-37004?

Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-37004 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37004?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37004: BerriAI LiteLLM server-side template injection in prompts endpoint

Q: Which products and versions are affected?

Berriai LiteLLM < 1.83.7; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.7.

Q: Is there a fix for CVE-2026-37004?

Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-37004 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-37004?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37004 · Severity: critical · CVSS 9.8 · Published 2026-08-27

LiteLLM is a popular library that manages interfaces to multiple large language models. The `/prompts/test` endpoint in versions up to 1.82.4 contains a critical flaw that allows unauthenticated attackers to inject arbitrary code through a template parameter. An attacker can exploit this to execute arbitrary commands on the server, gaining full control over the system and potentially accessing sensitive data or causing service outages.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-37004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37004 being exploited in the wild.
How severe is CVE-2026-37004?: Critical severity, with a CVSS score of 9.8, published 27 August 2026.
Which products and versions are affected?: Berriai LiteLLM < 1.83.7; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.7.
Is there a fix for CVE-2026-37004?: Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-37004 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37004?: Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litellm (PyPI): upgrade to 1.83.7 or later
```
pip install "litellm>=1.83.7"
```

Technical details

The vulnerability exists in the prompt endpoints component (litellm/proxy/prompts/prompt_endpoints.py) where user-supplied template content is processed through an unsandboxed jinja2.Environment object. The `/prompts/test` endpoint accepts a `dotprompt_content` parameter that is directly rendered as a Jinja2 template without proper input sanitization or sandboxing. This allows attackers to inject Jinja2 template directives that can access Python's built-in functions and object attributes to execute arbitrary OS commands. The root cause is the use of the standard `Environment` class instead of Jinja2's sandboxed variant. The fix, merged in commit d910a95, replaces the unsandboxed `Environment` with `ImmutableSandboxedEnvironment` from `jinja2.sandbox`, which restricts access to dangerous attributes and functions. Patched version 1.83.7 and later are not affected.

Affected products

BerriAI LiteLLM < 1.83.7

Identifiers

CVE-2026-37004
GHSA-6wvf-77m9-58rm
PYSEC-2026-3861

Timeline

2026-08-27: disclosed
2026-08-27: advisory
2026-04-09: patched: Fix committed on April 9, 2026; patched version 1.83.7 released April 19, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.