PYSEC-2026-3861
Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02
VLAI
Details
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
Severity
9.8 (Critical)
Impacted products
| Name | purl | litellm | pkg:pypi/litellm |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "litellm",
"purl": "pkg:pypi/litellm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.83.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.201",
"0.1.202",
"0.1.203",
"0.1.204",
"0.1.205",
"0.1.206",
"0.1.207",
"0.1.208",
"0.1.209",
"0.1.210",
"0.1.211",
"0.1.212",
"0.1.213",
"0.1.214",
"0.1.215",
"0.1.216",
"0.1.217",
"0.1.218",
"0.1.219",
"0.1.220",
"0.1.221",
"0.1.222",
"0.1.223",
"0.1.224",
"0.1.225",
"0.1.226",
"0.1.227",
"0.1.228",
"0.1.229",
"0.1.2291",
"0.1.230",
"0.1.231",
"0.1.232",
"0.1.233",
"0.1.234",
"0.1.235",
"0.1.236",
"0.1.237",
"0.1.238",
"0.1.3",
"0.1.31",
"0.1.32",
"0.1.330",
"0.1.331",
"0.1.34",
"0.1.341",
"0.1.343",
"0.1.345",
"0.1.347",
"0.1.348",
"0.1.349",
"0.1.351",
"0.1.352",
"0.1.353",
"0.1.354",
"0.1.356",
"0.1.360",
"0.1.361",
"0.1.362",
"0.1.363",
"0.1.364",
"0.1.365",
"0.1.366",
"0.1.367",
"0.1.368",
"0.1.369",
"0.1.370",
"0.1.371",
"0.1.372",
"0.1.373",
"0.1.375",
"0.1.376",
"0.1.379",
"0.1.380",
"0.1.381",
"0.1.383",
"0.1.384",
"0.1.385",
"0.1.386",
"0.1.387",
"0.1.388",
"0.1.389",
"0.1.392",
"0.1.393",
"0.1.394",
"0.1.398",
"0.1.399",
"0.1.400",
"0.1.401",
"0.1.402",
"0.1.403",
"0.1.404",
"0.1.405",
"0.1.410",
"0.1.411",
"0.1.412",
"0.1.415",
"0.1.419",
"0.1.420",
"0.1.421",
"0.1.422",
"0.1.424",
"0.1.425",
"0.1.426",
"0.1.429",
"0.1.433",
"0.1.434",
"0.1.435",
"0.1.436",
"0.1.437",
"0.1.438",
"0.1.439",
"0.1.440",
"0.1.441",
"0.1.442",
"0.1.443",
"0.1.444",
"0.1.445",
"0.1.446",
"0.1.447",
"0.1.448",
"0.1.449",
"0.1.450",
"0.1.451",
"0.1.452",
"0.1.456",
"0.1.457",
"0.1.459",
"0.1.460",
"0.1.461",
"0.1.464",
"0.1.465",
"0.1.475",
"0.1.477",
"0.1.479",
"0.1.480",
"0.1.481",
"0.1.482",
"0.1.486",
"0.1.487",
"0.1.488",
"0.1.490",
"0.1.491",
"0.1.492",
"0.1.493",
"0.1.494",
"0.1.495",
"0.1.497",
"0.1.500",
"0.1.501",
"0.1.504",
"0.1.507",
"0.1.508",
"0.1.509",
"0.1.510",
"0.1.511",
"0.1.512",
"0.1.516",
"0.1.517",
"0.1.518",
"0.1.520",
"0.1.525",
"0.1.530",
"0.1.531",
"0.1.533",
"0.1.535",
"0.1.536",
"0.1.537",
"0.1.538",
"0.1.544",
"0.1.546",
"0.1.547",
"0.1.548",
"0.1.549",
"0.1.550",
"0.1.551",
"0.1.552",
"0.1.553",
"0.1.554",
"0.1.555",
"0.1.556",
"0.1.557",
"0.1.558",
"0.1.559",
"0.1.560",
"0.1.561",
"0.1.562",
"0.1.563",
"0.1.567",
"0.1.568",
"0.1.569",
"0.1.570",
"0.1.574",
"0.1.578",
"0.1.580",
"0.1.582",
"0.1.583",
"0.1.585",
"0.1.586",
"0.1.587",
"0.1.590",
"0.1.591",
"0.1.593",
"0.1.595",
"0.1.596",
"0.1.597",
"0.1.598",
"0.1.600",
"0.1.601",
"0.1.604",
"0.1.605",
"0.1.607",
"0.1.609",
"0.1.610",
"0.1.615",
"0.1.618",
"0.1.619",
"0.1.620",
"0.1.621",
"0.1.623",
"0.1.624",
"0.1.625",
"0.1.626",
"0.1.629",
"0.1.630",
"0.1.631",
"0.1.632",
"0.1.634",
"0.1.635",
"0.1.636",
"0.1.638",
"0.1.639",
"0.1.641",
"0.1.642",
"0.1.643",
"0.1.644",
"0.1.645",
"0.1.646",
"0.1.647",
"0.1.648",
"0.1.649",
"0.1.650",
"0.1.651",
"0.1.652",
"0.1.674",
"0.1.680",
"0.1.681",
"0.1.683",
"0.1.685",
"0.1.686",
"0.1.687",
"0.1.689",
"0.1.690",
"0.1.692",
"0.1.693",
"0.1.696",
"0.1.697",
"0.1.698",
"0.1.700",
"0.1.700.dev0",
"0.1.700.dev1",
"0.1.700.dev2",
"0.1.700.dev3",
"0.1.700.dev4",
"0.1.700.dev5",
"0.1.702",
"0.1.704",
"0.1.706",
"0.1.714",
"0.1.714.dev1",
"0.1.715",
"0.1.716",
"0.1.719",
"0.1.720",
"0.1.721",
"0.1.723",
"0.1.724",
"0.1.729",
"0.1.736",
"0.1.738",
"0.1.743",
"0.1.745",
"0.1.746",
"0.1.747",
"0.1.748",
"0.1.749",
"0.1.750",
"0.1.751",
"0.1.758",
"0.1.765",
"0.1.769",
"0.1.7701",
"0.1.7713",
"0.1.772",
"0.1.774",
"0.1.780",
"0.1.781",
"0.1.784",
"0.1.786",
"0.1.788",
"0.1.789",
"0.1.793",
"0.1.794",
"0.1.805",
"0.1.806",
"0.1.807",
"0.1.813",
"0.1.814",
"0.1.815",
"0.1.816",
"0.1.817",
"0.1.818",
"0.1.819",
"0.1.820",
"0.1.821",
"0.1.824",
"0.10.0",
"0.10.1",
"0.11.1",
"0.12.10",
"0.12.11",
"0.12.12",
"0.12.4",
"0.12.4.dev1",
"0.12.4.dev2",
"0.12.5",
"0.12.5.dev1",
"0.12.7",
"0.12.7.dev1",
"0.12.8",
"0.12.9",
"0.13.0",
"0.13.1",
"0.13.1.dev1",
"0.13.1.dev2",
"0.13.1.dev3",
"0.13.2",
"0.13.2.dev1",
"0.13.3.dev1",
"0.13.3.dev2",
"0.13.6.dev1",
"0.13.6.dev2",
"0.13.6.dev3",
"0.13.7.dev1",
"0.14.0",
"0.14.0.dev1",
"0.14.1",
"0.2.5",
"0.2.6",
"0.3.0",
"0.3.1",
"0.4.0",
"0.4.4",
"0.5.2",
"0.5.3",
"0.5.4",
"0.5.6",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.6",
"0.7.1",
"0.7.1.dev1",
"0.7.1.dev2",
"0.7.1.dev3",
"0.7.10",
"0.7.3",
"0.7.4",
"0.7.5",
"0.7.9",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.6",
"0.9.0",
"0.9.1",
"0.9.2",
"0.9.2.dev1",
"1.0.0",
"1.0.0.dev1",
"1.0.3",
"1.0.3.dev1",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"1.10.0",
"1.10.1",
"1.10.10",
"1.10.11",
"1.10.2",
"1.10.3",
"1.10.4",
"1.10.6",
"1.10.8",
"1.10.9",
"1.10.dev11",
"1.11.0",
"1.11.1",
"1.12.0",
"1.12.1",
"1.12.2",
"1.12.3",
"1.12.5",
"1.12.5.dev1",
"1.12.6.dev1",
"1.12.6.dev2",
"1.12.6.dev3",
"1.12.6.dev4",
"1.12.6.dev5",
"1.13.2",
"1.14.0",
"1.14.0.dev1",
"1.14.1",
"1.14.2",
"1.14.3",
"1.14.4",
"1.2.0",
"1.3.1",
"1.3.3",
"1.3.3.dev1",
"1.3.3.dev2",
"1.3.3.dev3",
"1.4.0",
"1.53.1",
"1.53.1.dev1",
"1.53.2",
"1.53.3",
"1.53.4",
"1.53.5",
"1.53.6",
"1.53.7",
"1.53.8",
"1.53.9",
"1.54.0",
"1.54.1",
"1.55.0",
"1.55.1",
"1.55.10",
"1.55.11",
"1.55.12",
"1.55.2",
"1.55.3",
"1.55.4",
"1.55.6",
"1.55.7",
"1.55.8",
"1.55.9",
"1.56.10",
"1.56.2",
"1.56.3",
"1.56.4",
"1.56.5",
"1.56.6",
"1.56.8",
"1.56.8.dev4",
"1.56.8.dev5",
"1.56.8.dev6",
"1.56.8.dev7",
"1.56.9",
"1.57.0",
"1.57.1",
"1.57.10",
"1.57.11",
"1.57.2",
"1.57.3",
"1.57.4",
"1.57.5",
"1.57.7",
"1.57.7.dev1",
"1.57.8",
"1.58.0",
"1.58.1",
"1.58.2",
"1.58.4",
"1.59.0",
"1.59.1",
"1.59.1.dev1",
"1.59.10",
"1.59.10.dev1",
"1.59.12",
"1.59.2",
"1.59.3",
"1.59.5",
"1.59.6",
"1.59.7",
"1.59.8",
"1.59.9",
"1.6.0",
"1.60.0",
"1.60.2",
"1.60.4",
"1.60.5",
"1.60.6",
"1.60.7",
"1.60.8",
"1.60.9",
"1.61.0",
"1.61.0.dev1",
"1.61.1",
"1.61.11",
"1.61.13",
"1.61.15",
"1.61.16",
"1.61.17",
"1.61.19",
"1.61.2",
"1.61.20",
"1.61.3",
"1.61.4",
"1.61.5",
"1.61.6",
"1.61.7",
"1.61.8",
"1.61.9",
"1.62.1",
"1.62.4",
"1.63.0",
"1.63.0.dev12",
"1.63.11",
"1.63.11.dev1",
"1.63.12",
"1.63.14",
"1.63.2",
"1.63.3",
"1.63.4.dev1",
"1.63.5",
"1.63.6",
"1.63.7",
"1.63.8",
"1.64.1",
"1.65.0",
"1.65.0.post1",
"1.65.1",
"1.65.3",
"1.65.4",
"1.65.4.post1",
"1.65.5",
"1.65.6",
"1.65.7",
"1.65.8",
"1.66.0",
"1.66.1",
"1.66.2",
"1.66.3",
"1.67.0",
"1.67.0.post1",
"1.67.1",
"1.67.2",
"1.67.4",
"1.67.4.dev1",
"1.67.4.post1",
"1.67.5",
"1.67.6",
"1.68.0",
"1.68.1",
"1.68.1.dev1",
"1.68.2",
"1.69.0",
"1.69.1",
"1.69.2",
"1.69.3",
"1.7.1",
"1.7.11",
"1.7.12",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.70.0",
"1.70.2",
"1.70.4",
"1.71.0",
"1.71.1",
"1.71.2",
"1.71.3",
"1.72.0",
"1.72.1",
"1.72.2",
"1.72.2.post1",
"1.72.3",
"1.72.4",
"1.72.5.dev1",
"1.72.5.dev2",
"1.72.5.dev3",
"1.72.6",
"1.72.6.post1",
"1.72.6.post2",
"1.72.7",
"1.72.7.dev1",
"1.72.7.dev7",
"1.72.9",
"1.73.0",
"1.73.0.post1",
"1.73.0rc1",
"1.73.1",
"1.73.2",
"1.73.6",
"1.73.6.post1",
"1.73.6rc2",
"1.73.7",
"1.73.7.dev1",
"1.73.7.dev2",
"1.73.7.dev3",
"1.73.7.dev4",
"1.74.0",
"1.74.0.post1",
"1.74.0.post2",
"1.74.1",
"1.74.12",
"1.74.14",
"1.74.15",
"1.74.15.post1",
"1.74.15.post2",
"1.74.2",
"1.74.3",
"1.74.3.post1",
"1.74.3rc1",
"1.74.3rc2",
"1.74.3rc3",
"1.74.4",
"1.74.4.dev1",
"1.74.6",
"1.74.7",
"1.74.7.post1",
"1.74.7.post2",
"1.74.7rc1",
"1.74.8",
"1.74.8.dev2",
"1.74.9",
"1.74.9.dev1",
"1.74.9.dev2",
"1.74.9.post1",
"1.74.9.post2",
"1.75.0",
"1.75.2",
"1.75.3",
"1.75.4",
"1.75.5.post1",
"1.75.5.post2",
"1.75.6",
"1.75.7",
"1.75.8",
"1.75.9",
"1.76.0",
"1.76.1",
"1.76.2",
"1.76.3",
"1.77.0",
"1.77.1",
"1.77.2.post1",
"1.77.3",
"1.77.4",
"1.77.4.dev1",
"1.77.5",
"1.77.7",
"1.78.0",
"1.78.0rc2",
"1.78.2",
"1.78.3",
"1.78.4",
"1.78.5",
"1.78.6",
"1.78.7",
"1.79.0",
"1.79.0.dev1",
"1.79.0.dev2",
"1.79.0.dev3",
"1.79.1",
"1.79.2",
"1.79.3",
"1.79.3.dev8",
"1.8.1",
"1.80.0",
"1.80.10",
"1.80.11",
"1.80.12",
"1.80.13",
"1.80.15",
"1.80.16",
"1.80.17",
"1.80.5",
"1.80.6",
"1.80.7",
"1.80.8",
"1.80.9",
"1.81.0",
"1.81.1",
"1.81.10",
"1.81.11",
"1.81.12",
"1.81.13",
"1.81.14",
"1.81.15",
"1.81.16",
"1.81.3",
"1.81.4",
"1.81.5",
"1.81.6",
"1.81.7",
"1.81.8",
"1.81.9",
"1.81.9.dev1",
"1.82.0",
"1.82.1",
"1.82.2",
"1.82.3",
"1.82.4",
"1.82.5",
"1.82.6",
"1.83.0",
"1.83.1",
"1.83.2",
"1.83.3",
"1.83.4",
"1.83.5",
"1.83.6",
"1.9.0",
"1.9.1",
"1.9.2",
"1.9.3",
"1.9.4",
"1.9.5",
"1.9.dev0"
]
}
],
"aliases": [
"CVE-2026-37004",
"GHSA-6wvf-77m9-58rm"
],
"details": "BerriAI litellm \u003c=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.",
"id": "PYSEC-2026-3861",
"modified": "2026-09-10T11:02:13.665443Z",
"published": "2026-09-10T09:44:57.753158Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37004"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"
},
{
"type": "WEB",
"url": "https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/litellm"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6wvf-77m9-58rm"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…