GHSA-xqmj-j6mv-4862: LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Summary

LiteLLM's POST /prompts/test endpoint rendered user-supplied prompt templates without sandboxing, so a crafted template could run arbitrary code inside the LiteLLM Proxy process. Any caller with a valid proxy API key can reach the endpoint, which may expose environment secrets and allow host commands depending on deployment.

Mitigation

Fixed in 1.83.7-stable, which switches the prompt template renderer to a sandboxed environment. LiteLLM recommends upgrading to 1.83.7-stable or later. If upgrading is not immediately possible, block POST /prompts/test at your reverse proxy or API gateway, and review and rotate API keys that should not have access to prompt management routes.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Related items

• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News