{"id":"CVE-2026-37004","aliases":["PYSEC-2026-3861"],"url":"https://o3.security/vulnerability/CVE-2026-37004","summary":"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint","details":"BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.","published":"2026-08-27T21:31:31Z","modified":"2026-09-10T12:25:33.314139929Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00548,"percentile":0.44588,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"litellm","fixedVersion":"1.83.7"}],"fix":{"url":"https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c","label":"BerriAI/litellm@d910a95"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37004"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"},{"type":"WEB","url":"https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T12:25:33.314139929Z"}}