CVE-2026-42203highCWE-1336CWE-94

CVE-2026-42203: high-severity vulnerability in BerriAI litellm

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

Published · Updated

Follow this CVE+ Monitor litellm+ Monitor litellm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.6epss 0.4%
from disclosure to weapon7 days
Published on NVDMay 8
1st PoC+7d
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
BerriAI · litellm
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BerriAI litellm

In the same product, most dangerous first.

CVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 91.4%KEVCVE-2026-42208CRITICALLiteLLM: SQL injection in Proxy API key verificationEPSS 89.4%KEVCVE-2026-59822HIGHLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackEPSS 0.8%KEVCVE-2026-35029HIGHLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointEPSS 38.6%CVE-2026-49468CRITICALLiteLLM: Authentication Bypass via Host Header InjectionEPSS 3.0%CVE-2026-47101HIGHLiteLLM < 1.83.14 Privilege Escalation via API Key GenerationEPSS 1.2%