LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
Fix
Public exploits 1
- Astianjy/CVE-2026-42203 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862 Mitigation, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.6 · litellmNVD modified 2026-10-26 20:10
Affected (CPE criteria) 1
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*
References 5
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable Product, Release Notes
- https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862 Mitigation, Patch, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-42203
- https://bugzilla.redhat.com/show_bug.cgi?id=2467917
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42203.json