EUVD-2026-28502
GHSA-xqmj-j6mv-4862
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5Blast Radius
ecosystem impact- 1 pypi packages depend on litellm (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.80.5.
DescriptionCVE.org
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
AnalysisAI
Server-side template injection in LiteLLM Proxy versions 1.80.5 through 1.83.6 allows authenticated users to execute arbitrary code via the POST /prompts/test endpoint. Any user with a valid proxy API key can submit malicious prompt templates that escape sandboxing and run commands in the proxy server process, exposing environment secrets like provider API keys and database credentials. This vulnerability affects deployments using LiteLLM as an AI gateway proxy server. No active exploitation confirmed (not in CISA KEV), but GitHub advisory and patch are publicly available, increasing exploit likelihood. CVSS 8.6 (High) with network attack vector and low complexity, though PR:L requirement limits exposure to authenticated attackers only.
Technical ContextAI
LiteLLM is a Python-based proxy server that provides a unified OpenAI-compatible API interface for multiple LLM providers. The vulnerability (CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine) resides in the prompt template rendering functionality at the POST /prompts/test endpoint. This endpoint accepts user-provided template strings and renders them using a template engine without proper sandboxing. Template injection attacks exploit this by inserting special syntax (typically Jinja2 or similar Python template engine directives) that break out of the intended template context. In Python template engines, attackers can access internal object attributes like __class__.__mro__ to traverse the object hierarchy and reach dangerous functions like subprocess.Popen or os.system. The affected component is the pip package 'litellm' with CPE cpe:2.3:a:berriai:litellm covering versions 1.80.5 through 1.83.6. The vulnerability exists in the proxy server component specifically, not the core LiteLLM library used as a client.
RemediationAI
Upgrade to LiteLLM version 1.83.7-stable or later, which implements sandboxed template rendering that blocks dangerous object attribute access (confirmed fix at https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable). For Docker deployments, use ghcr.io/berriai/litellm:v1.83.7-stable and verify image signature with cosign using the public key at https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub per release documentation. If immediate upgrade is not feasible, implement two compensating controls: (1) Block POST requests to /prompts/test at your reverse proxy, API gateway, or web application firewall-this prevents all access to the vulnerable endpoint but disables legitimate prompt testing functionality for development teams; (2) Audit and rotate API keys to ensure only trusted users retain proxy access, then implement strict key management policies-this reduces attacker pool but doesn't eliminate risk if any key holder is compromised. Note that blocking the endpoint is the only workaround that fully mitigates the vulnerability; key rotation only reduces probability. Both workarounds should be temporary measures pending upgrade to 1.83.7.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today