LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-42203. PoCs published by Astianjy.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-42203, demonstrating a Server-Side Template Injection (SSTI) vulnerability in LiteLLM's /prompts/test endpoint. The exploit uses a Jinja2 template injection to execute arbitrary Python code, confirmed via a CEYE callback mechanism.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2026-42203, demonstrating a Server-Side Template Injection (SSTI) vulnerability in LiteLLM's /prompts/test endpoint. The exploit uses a Jinja2 template injection to execute arbitrary Python code, confirmed via a CEYE callback mechanism.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H