LiteLLM Unauthenticated SSTI to RCE in /prompts/test Endpoint
First seen Sep 10, 2026 · Updated Sep 10, 2026 · CVSS 9.8
LiteLLM's /prompts/test endpoint passes user-controlled input into an unsandboxed jinja2.Environment, allowing an unauthenticated attacker to inject template syntax and execute arbitrary OS commands on the server. Since LiteLLM is widely deployed as an LLM gateway/proxy in front of many AI agent stacks, this gives attackers a direct path to full host compromise without any credentials.
Technical Analysis
The vulnerability stems from the dotprompt_content parameter being rendered through a standard, unsandboxed Jinja2 environment rather than a restricted or logic-less templating engine. An attacker sends a crafted template payload to the /prompts/test endpoint (no authentication required), and Jinja2's Python object introspection capabilities (e.g., via __class__ and __globals__ chains) are used to reach os/subprocess functionality and execute arbitrary commands. Because LiteLLM often sits as a proxy/router in front of multiple LLM backends and agent orchestration layers, compromise here yields access to API keys, upstream model credentials, and any downstream tools or agents the proxy is authorized to call. This crosses trust boundaries from a single HTTP request into full server-level code execution, effectively poisoning the entire agent infrastructure that depends on the LiteLLM instance.
Affected Systems
LiteLLM
Detection Signatures
- POST requests to /prompts/test with dotprompt_content containing Jinja2 control syntax (e.g., {{, {%, __class__, __globals__, __mro__, __subclasses__ patterns)
- Unexpected subprocess/os command execution spawned from the litellm proxy process
- Requests to /prompts/test from unauthenticated or unexpected source IPs
- Anomalous outbound network connections or file system access originating from the LiteLLM server process
- WAF/IDS alerts for SSRF/SSTI-style payloads targeting LiteLLM endpoints
Remediation Steps
- 1
Upgrade LiteLLM
Update to litellm >= 1.83.7 (or the patched release specified in GHSA-6wvf-77m9-58rm) immediately, as this fixes the unsandboxed Jinja2 rendering.
- 2
Restrict network exposure
Ensure the /prompts/test endpoint and LiteLLM management API are not exposed to the public internet; place behind authentication, VPN, or an API gateway with strict access controls.
- 3
Enforce authentication on all endpoints
Audit LiteLLM deployment configuration to confirm all admin/test endpoints require valid API keys or auth tokens, not just the inference endpoints.
- 4
Sandbox template rendering
If custom prompt templating is required, use a sandboxed Jinja2 environment (e.g., SandboxedEnvironment) or a non-Turing-complete templating approach going forward.
- 5
Monitor and rotate credentials
Review logs for exploitation attempts, rotate any API keys/secrets accessible to the LiteLLM process, and audit downstream systems the proxy could reach.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.