LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Impact
The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process.
The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host.
Proxy deployments running an affected version are in scope.
Patches
The issue is fixed in 1.83.7-stable. The fix switches the prompt template renderer to a sandboxed environment that blocks the attributes this attack relies on.
LiteLLM recommends upgrading to 1.83.7-stable or later.
Workarounds
If upgrading is not immediately possible:
- Block
POST /prompts/testat your reverse proxy or API gateway. - Review and rotate API keys that should not have access to prompt management routes.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | litellm | >= 1.80.5, < 1.83.7 | 1.83.7 |
Referencias
- https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862
- https://nvd.nist.gov/vuln/detail/CVE-2026-42203
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- https://pypi.org/project/litellm
- https://github.com/advisories/GHSA-xqmj-j6mv-4862
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-1336- Plataforma
- Python (PyPI)
- Paquete
litellm- Publicada
- 24.04.2026
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2602 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-xqmj-j6mv-4862 - CC BY 4.0
Historial de vulnerabilidades: litellm
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 42
- Primera → última
- 04.2024 09.2026
- Sin corrección
- 14
- Explotada en ataques
- 3
Distribución por gravedad
- Crítica 7
- Alta 17
- Media 8
- Baja 9
- Sin evaluar 1
Divulgaciones por año
- 2024: 8
- 2025: 6
- 2026: 28
-
LiteLLM: Server-Side Template Injection in /prompts/test endpoint esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.