CVE-2026-37004

BerriAI LiteLLM versions up to and including 1.82.4 contain a server-side template injection (SSTI) flaw in the /prompts/test endpoint of the LiteLLM proxy, caused by rendering user-supplied input with an unsandboxed jinja2.Environment. An unauthenticated remote attacker can trigger it by sending a crafted dotprompt_content parameter to that endpoint, which is evaluated as a Jinja2 template. Because the template environment is unsandboxed, evaluation escapes into the underlying system and lets the attacker execute arbitrary OS commands on the host running the proxy. Any deployment running LiteLLM 1.82.4 or earlier is affected, with highest risk on proxy instances reachable over the network without authentication; CVSS 9.8 reflects full server compromise with high confidentiality, integrity, and availability impact. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.5% probability of exploitation within 30 days.

What to do: Upgrade LiteLLM to a release newer than 1.82.4 as soon as a patched version is available, prioritizing any proxy instance reachable by unauthenticated users. As interim mitigation, restrict network access to the /prompts/test endpoint (or the whole proxy) and avoid passing untrusted dotprompt_content input. Check access logs for requests to /prompts/test containing dotprompt_content parameters and review hosts for signs of unexpected command execution.