Unauthenticated RCE via server-side template injection in LiteLLM's /prompts/test endpoint

Undisclosed·LiteLLM proxy/AI gateway (BerriAI litellm)Unresolved

LiteLLM's /prompts/test endpoint rendered the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment, letting an unauthenticated remote attacker inject a Jinja2 template payload that executes arbitrary OS commands on the host running the proxy.

Blast radius

Any unpatched LiteLLM proxy (<=1.82.4) exposing the /prompts/test endpoint is remotely exploitable for arbitrary command execution with no authentication required; the advisory does not disclose specific victims, exploitation in the wild, or a count of affected deployments.

Root cause

The prompt-testing endpoint passed user-controlled template content directly into jinja2.Environment.from_string/render without a sandboxed environment or input restrictions, turning a templating feature into a code-execution primitive.

How it was caught

Found and reported as a vulnerability (assigned CVE-2026-37004 / GHSA-6wvf-77m9-58rm) rather than discovered via an observed breach; no incident response or exploitation timeline is disclosed in the advisory.

What changed

The GitHub Security Advisory lists patched versions as 'Unknown' at time of publication; no fixed release or remediation commit is documented in the sources retrieved.

Take-awayNever pass unauthenticated, user-controlled input into a Jinja2 (or any templating engine) Environment without SandboxedEnvironment or equivalent restrictions — template rendering endpoints in LLM gateways are effectively RCE endpoints if unsandboxed.