CVE-2026-37004: 
Chainguard vulnerability analysis and mitigation

CVE-2026-37004 is a Server-Side Template Injection (SSTI) vulnerability in BerriAI LiteLLM that allows unauthenticated remote attackers to execute arbitrary OS commands. It affects LiteLLM versions up to and including 1.82.4, with the fix introduced in version 1.83.7. The vulnerability was published on August 27, 2026, and reviewed in the GitHub Advisory Database on September 8, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Feedly).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336): LiteLLM's /prompts/test endpoint processes the dotprompt_content parameter using an unsandboxed jinja2.Environment, allowing injected template expressions to be evaluated without restriction. Because Jinja2's default environment provides access to Python internals (e.g., __class__, __mro__, __subclasses__), an attacker can traverse the object hierarchy to reach OS-level functions and execute arbitrary commands. No authentication is required, and the attack is network-accessible with low complexity. The vulnerable code path is located at litellm/proxy/prompts/prompt_endpoints.py around line 1073 (Github Advisory, LiteLLM Source).

Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary OS commands with the privileges of the LiteLLM process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive data (including API keys, model configurations, and user data), modify or destroy system files, establish persistent backdoors, and use the compromised host as a pivot point for lateral movement within the network (Github Advisory, Feedly).

As of the time of reporting, there is no confirmed public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.548% (44th percentile), indicating a moderate near-term exploitation probability (Github Advisory). The NVD SSVC assessment notes the vulnerability is automatable with total technical impact, making it a high-priority patching target despite the current lack of observed exploitation.

1. Reconnaissance: Identify internet-facing LiteLLM proxy instances (version ≤ 1.82.4) using tools like Shodan or Censys by searching for LiteLLM service banners or known API paths such as /prompts/test.
2. Craft malicious request: Prepare an HTTP POST request targeting the /prompts/test endpoint with a dotprompt_content parameter containing a Jinja2 SSTI payload, e.g., {{ ''.__class__.__mro__[1].__subclasses__()[<index>]('id', shell=True, stdout=-1).communicate() }}.
3. Inject payload: Send the crafted request without any authentication headers, as the endpoint does not enforce authentication checks for this parameter.
4. Achieve OS command execution: The unsandboxed jinja2.Environment evaluates the injected template expression server-side, executing the embedded OS command with the privileges of the LiteLLM process.
5. Establish persistence or exfiltrate data: Use the RCE capability to download a reverse shell, exfiltrate API keys or model credentials stored in the environment, or pivot to other internal services (Github Advisory, LiteLLM Source).

• Network: Unexpected HTTP POST requests to /prompts/test from external or untrusted IP addresses; outbound connections from the LiteLLM server to unknown external hosts (potential reverse shell or data exfiltration).
• Logs: Web/proxy access logs showing POST requests to /prompts/test with unusually long or encoded dotprompt_content values containing Jinja2 syntax (e.g., {{, }}, __class__, __subclasses__, subprocess, os.popen); application error logs showing Jinja2 template evaluation exceptions.
• Process: Unexpected child processes spawned by the LiteLLM Python process (e.g., /bin/sh, /bin/bash, curl, wget, python3, nc); unusual process trees originating from the LiteLLM service account.
• File System: New or modified files in the LiteLLM installation directory, temporary directories, or cron job locations; presence of web shells or unauthorized scripts created by the LiteLLM process user.

The primary remediation is to upgrade BerriAI LiteLLM to version 1.83.7 or later, which contains the patch for this vulnerability (Github Advisory). The fix is available in the tagged release v1.83.7-stable (commit d910a95). If immediate upgrade is not possible, apply the following interim mitigations: (1) restrict network access to the /prompts/test endpoint to trusted internal sources only via firewall or reverse proxy ACLs; (2) implement input validation and sanitization for the dotprompt_content parameter; and (3) replace the unsandboxed jinja2.Environment with Jinja2's SandboxedEnvironment to restrict access to dangerous Python internals.

The vulnerability was noted in a PoC/vulnerability digest published by Tony Harris on September 6, 2026, aggregating notable CVEs of the week (PoC Week Digest). A dedicated technical write-up was published at yerangamage.com covering the SSTI-to-RCE exploitation path. No major vendor statements or widespread social media discussion have been identified beyond standard vulnerability database entries.