LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
OSV · 1 source
What's on the official record
The OSV advisory GHSA-6wvf-77m9-58rm reports a server-side template injection (SSTI) vulnerability in the PyPI package litellm, in the llm_gateway layer. The advisory states that BerriAI litellm versions up to and including 1.82.4 are vulnerable, and that the issue is fixed in version 1.83.7. The advisory assigns the vulnerability a severity of CRITICAL and maps it to CWE-1336. The advisory reports that an unauthenticated remote attacker can execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint, due to use of an unsandboxed jinja2.Environment. The advisory is dated 27 August 2026 and carries the alias CVE-2026-37004.
Assessment
For a platform or AI-stack owner, the record lets you check the litellm version pinned in any deployed gateway and confirm whether it is at or below 1.82.4, the range the advisory states is vulnerable. The advisory names a fixed version, 1.83.7, so the record supports a patch decision to that version or later. The record also lets you check whether the /prompts/test endpoint is reachable in your deployment, since the advisory attributes the command-execution path to that endpoint.
For a deal team, the record lets you scope diligence on any target that runs litellm as part of its AI or gateway stack, by asking which version is deployed and whether the /prompts/test endpoint is exposed. The advisory states a fixed version, so the record supports conditioning a transaction on confirmation that the target is at 1.83.7 or later. The record does not state any incident, loss, or named victim, so it supports a version-check diligence step rather than a loss estimate.
What would change this call
A statement from the advisory or the maintainer that the fixed version 1.83.7 does not fully remediate the issue, or that additional affected versions exist, would change the patch and diligence guidance above.
What to check next
| Check | Why |
|---|---|
| litellm version in deployed gateways | Confirm whether it is at or below 1.82.4, the range the advisory states is vulnerable |
| Reachability of the /prompts/test endpoint | The advisory attributes the command-execution path to this endpoint |
| Whether the fixed version 1.83.7 is applied | The advisory names 1.83.7 as the fixed version |
Confidence
Filed 23 October 2026 from the record dated 27 August 2026. The note is drawn from a single OSV advisory row; the affected versions, fixed version, severity, and endpoint are stated directly in that record.
Sources
[1] LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint — https://github.com/advisories/GHSA-6wvf-77m9-58rm