AIKIDO-2026-854642
litellm is vulnerable to Server-Side Template Injection (SSTI)
98
Critical Risk
This Affects:
litellmTL;DR
The LiteLLM proxy's /prompts/test endpoint passes a caller supplied dotprompt_content parameter through an unsandboxed jinja2.Environment instead of keeping it as static text. An unauthenticated remote caller can craft dotprompt_content using Jinja2 template syntax to reach Python internals and run arbitrary operating system commands on the proxy host. The fix removes the unsandboxed Jinja2 path from the endpoint.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
litellm is vulnerable to Server-Side Template Injection (SSTI) in versions 0.0.1 - 1.83.6.
How to fix this
Upgrade the litellm library to the patch version.
Links
GitHub Release
Other
github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073
yerangamage.com/cves/detail/?slug=litellm-ssti-rce
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.