CVE-2026-42203: LiteLLM code execution through prompt template rendering in /prompts/test

Summary

LiteLLM, an AI gateway proxy that calls LLM APIs in OpenAI or native format, is affected from version 1.80.5 up to but not including 1.83.7. The POST /prompts/test endpoint rendered user-supplied prompt templates without sandboxing, so a crafted template could run arbitrary code inside the LiteLLM Proxy process. Any caller holding a valid proxy API key can reach the endpoint, and depending on deployment this may expose environment secrets such as provider API keys or database credentials and allow commands on the host.

Mitigation

Fixed in 1.83.7.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• InfoSay Shibboleth: Fingerprinting the LLMs and Harnesses Behind Agentic AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)