CVE-2026-37004 BerriAI CVE debrief

Who should care

Organizations using BerriAI litellm version <=1.82.4 should prioritize patching this vulnerability. Security teams and administrators responsible for web applications and server security should be aware of this critical vulnerability and take immediate action to mitigate the risk.

Technical summary

The CVE-2026-37004 vulnerability is a Server-Side Template Injection (SSTI) issue in BerriAI litellm version <=1.82.4. This vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands by exploiting the unsandboxed jinja2.Environment in the /prompts/test endpoint. The vulnerability is considered critical with a CVSS score of 9.8. The exploitation of this vulnerability could lead to unauthorized execution of OS commands, potentially resulting in compromise of the affected system. The use of an unsandboxed jinja2.Environment in the /prompts/test endpoint enables the injection of malicious templates, which can be used to execute arbitrary OS commands. It is essential for organizations using BerriAI litellm version <=1.82.4 to prioritize patching this vulnerability and implement compensating controls to mitigate the risk.

Defensive priority

Immediate attention is required due to the critical CVSS score of 9.8. Server-Side Template Injection (SSTI) vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands.

Recommended defensive actions

• Inventory and verify the version of BerriAI litellm in use.
• Apply the latest patch or upgrade to a version greater than 1.82.4.
• Implement compensating controls such as web application firewalls to detect and prevent suspicious traffic.
• Monitor the /prompts/test endpoint for unusual activity.
• Restrict access to the /prompts/test endpoint to authenticated users only.

Evidence notes

The CVE-2026-37004 record indicates a Server-Side Template Injection (SSTI) vulnerability in BerriAI litellm <=1.82.4. The vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to the use of an unsandboxed jinja2.Environment. Evidence is based on limited source detail, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.