CVE-2026-37004 in Litellm
Summary
by MITRE • 08/27/2026
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in LiteLLM versions prior to 1.82.4 represents a critical Server-Side Template Injection (SSTI) flaw that compromises the integrity and availability of systems running this library. This security defect is rooted in the improper handling of user-supplied input within the /prompts/test endpoint, specifically through the dotprompt_content parameter. The core technical issue stems from the use of an unsandboxed Jinja2 environment to process template strings provided by external actors. In a secure implementation, template engines should operate within a restricted sandbox that limits access to dangerous attributes and methods. However, in this vulnerable configuration, the engine executes arbitrary Python code embedded within the template string without sufficient isolation or validation checks against malicious payloads.
From an operational perspective, this vulnerability allows unauthenticated remote attackers to achieve Remote Code Execution (RCE) on the host system where LiteLLM is deployed. By crafting a specific dotprompt_content payload containing Jinja2 exploitation syntax, such as accessing the _class_ and _mro_ attributes of Python objects or invoking os.system commands through template filters, an attacker can bypass standard input validation mechanisms. The lack of authentication for this endpoint exacerbates the risk, making it trivially exploitable by any internet-facing service utilizing these vulnerable versions without requiring prior credentials or session hijacking.
The impact of successful exploitation is severe, potentially leading to complete system compromise. Attackers can read sensitive configuration files, exfiltrate database contents, install backdoors, or use the compromised server as a pivot point for further network intrusion. This aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), and specifically maps to ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries execute commands via system shells. The ability to run arbitrary OS commands means that the confidentiality, integrity, and availability of all data processed by the LiteLLM instance are at immediate risk.
Mitigation strategies must prioritize an immediate upgrade to version 1.82.4 or later, which addresses this flaw by implementing proper sandboxing for Jinja2 environments. If upgrading is not immediately feasible, organizations should implement strict input validation and sanitization routines on the dotprompt_content parameter before it reaches the template engine. Additionally, deploying a Web Application Firewall (WAF) with rules capable of detecting SSTI patterns can provide an additional layer of defense by blocking malicious payloads at the network perimeter. It is also recommended to restrict access to the /prompts/test endpoint through authentication and IP whitelisting where possible, ensuring that only authorized internal services or administrators can interact with this functionality until a permanent patch is applied.