# CVE-2026-37004: BerriAI LiteLLM server-side template injection in prompts endpoint

Source: https://junglewise.ai/threats/cve-2026-37004-berriai-litellm-server-side-template-injection-in-prompts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-37004 · Severity: critical · CVSS 9.8 · Published 2026-08-27

LiteLLM is a popular library that manages interfaces to multiple large language models. The `/prompts/test` endpoint in versions up to 1.82.4 contains a critical flaw that allows unauthenticated attackers to inject arbitrary code through a template parameter. An attacker can exploit this to execute arbitrary commands on the server, gaining full control over the system and potentially accessing sensitive data or causing service outages.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-37004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37004 being exploited in the wild.

**How severe is CVE-2026-37004?** Critical severity, with a CVSS score of 9.8, published 27 August 2026.

**Which products and versions are affected?** Berriai LiteLLM < 1.83.7; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.83.7.

**Is there a fix for CVE-2026-37004?** Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37004 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-37004?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.83.7 or later

  ```sh
  pip install "litellm>=1.83.7"
  ```


## Technical details

The vulnerability exists in the prompt endpoints component (litellm/proxy/prompts/prompt_endpoints.py) where user-supplied template content is processed through an unsandboxed jinja2.Environment object. The `/prompts/test` endpoint accepts a `dotprompt_content` parameter that is directly rendered as a Jinja2 template without proper input sanitization or sandboxing. This allows attackers to inject Jinja2 template directives that can access Python's built-in functions and object attributes to execute arbitrary OS commands. The root cause is the use of the standard `Environment` class instead of Jinja2's sandboxed variant. The fix, merged in commit d910a95, replaces the unsandboxed `Environment` with `ImmutableSandboxedEnvironment` from `jinja2.sandbox`, which restricts access to dangerous attributes and functions. Patched version 1.83.7 and later are not affected.

## Affected products

- BerriAI LiteLLM < 1.83.7

## Identifiers

- CVE-2026-37004
- GHSA-6wvf-77m9-58rm
- PYSEC-2026-3861

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: advisory
- 2026-04-09: patched: Fix committed on April 9, 2026; patched version 1.83.7 released April 19, 2026

## References

- [https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py](https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py)
- [https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce](https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce)
- [https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c](https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c)
- [https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [LiteLLM proxy authentication bypass via reused crypto context](https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)