CVE-2026-37004
Description
A flaw was found in litellm. This Server-Side Template Injection (SSTI) vulnerability allows unauthenticated remote attackers to execute arbitrary operating system (OS) commands. The flaw occurs due to the use of an unsandboxed jinja2.Environment, which can be exploited by crafting a malicious dotprompt_content parameter in the /prompts/test endpoint.
Statement
This vulnerability is rated as Critical severity because unauthenticated remote attackers can execute arbitrary code on the underlying host with the privileges of the application process, requiring no user interaction or prior credentials. In environments where the proxy interface is directly exposed to untrusted networks, exploitation allows full compromise of the application host and its resources. Deployments operating behind strict ingress access controls or within isolated internal networks face reduced reachability, though any network client capable of reaching the HTTP service can trigger the flaw.
Mitigation
Limit exposure by restricting network access to the litellm service to localhost or trusted internal networks, or configure an upstream reverse proxy or ingress controller to block requests directed to the `/prompts/test` path.
If restricting service access to a trusted subnet using firewalld (for example, service port 4000 and trusted network 192.168.1.0/24):
firewall-cmd --permanent --zone=drop --add-port=4000/tcp
firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24
firewall-cmd --reload
If utilizing an upstream reverse proxy (such as Nginx), block requests targeting the vulnerable endpoint:
location = /prompts/test {
return 403;
}
Warning: Reloading firewall rules or proxy services may temporarily disrupt established network connections. Blocking the endpoint will disable prompt testing capabilities for clients.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 10 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
An attacker could insert an expression that references private data, which is then included in the output.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
An attacker could execute arbitrary expressions.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
