REDHAT-BUG-2467917: High severity LiteLLM vulnerability
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteLLM Proxyto a version that resolves this vulnerability.Fixed in 1.83.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user who has a valid LiteLLM Proxy API key can access the affected endpoint. The endpoint does not require additional privileges beyond authentication with a proxy API key.
What could an attacker gain from successful exploitation?
A crafted prompt template can execute arbitrary code in the LiteLLM Proxy process. Depending on deployment, this may expose process environment secrets such as provider API keys or database credentials and permit commands to run on the host.
Which versions are affected and what version fixes the issue?
LiteLLM versions from 1.80.5 up to, but not including, 1.83.7 are affected. The issue is patched in version 1.83.7.