8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42203

CVE-2026-42203: LiteLLM: Server-Side Template Injection in /prompts/test endpoint

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42203

CVE-2026-42203:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
litellm	pip	>= 1.80.5, < 1.83.7	1.83.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a Server-Side Template Injection (SSTI) in the /prompts/test endpoint of LiteLLM. The endpoint uses a jinja2 template engine to render user-provided templates. Prior to the patch, the Jinja2 environment was not sandboxed, allowing an authenticated attacker to craft a malicious template that, when rendered, would execute arbitrary code on the server.

The patch, found in commit 9b33d9d4276a27fe96becaaf6b41a4d622385401, addresses this issue by replacing the standard jinja2.Environment with jinja2.sandbox.ImmutableSandboxedEnvironment within the PromptManager.__init__ method. This sandboxes the execution of templates, restricting access to unsafe attributes and methods, thereby mitigating the SSTI vulnerability.

While PromptManager.__init__ is the function where the vulnerable configuration is created, the function that would appear in a runtime profile during an exploit is the one that handles the POST /prompts/test request and calls the render method on the template. Although the exact name of this function could not be determined from the provided information, any stack trace related to this vulnerability would involve the PromptManager class and the rendering of a Jinja2 template.

Vulnerable functions

PromptManager.__init__

litellm/integrations/dotprompt/prompt_manager.py

The vulnerability lies in the `__init__` method of the `PromptManager` class, which was using a non-sandboxed `jinja2.Environment`. This allowed for Server-Side Template Injection (SSTI) when rendering user-supplied templates from the `/prompts/test` endpoint. The patch replaces the vulnerable environment with `jinja2.sandbox.ImmutableSandboxedEnvironment`, which prevents the execution of arbitrary code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.