499 matches found
CVE-2026-42203 LiteLLM: Server-Side Template Injection in /prompts/test endpoint
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the...
CVE-2026-42203
LiteLLM (proxy server) is affected from version 1.80.5 up to before 1.83.7 due to Server-Side Template Injection in the POST /prompts/test endpoint. The endpoint renders user-supplied prompt templates without sandboxing, enabling arbitrary code execution inside the LiteLLM Proxy process when auth...
CVE-2026-42203 LiteLLM: Server-Side Template Injection in /prompts/test endpoint
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the...
CVE-2026-42203
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the...
EUVD-2026-28502
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the...
EUVD-2026-28507
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration i...
CVE-2026-42271
Summary: CVE-2026-42271 affects LiteLLM up to v1.83.7, where two MCP preview endpoints (POST /mcp-rest/test/connection and /tools/list) could spawn arbitrary commands via stdio transport when provided a full server config, restricted only by a valid API key. The subprocess ran with the proxy’s pr...
CVE-2026-42271
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration i...
CVE-2026-42271 LiteLLM: Authenticated command execution via MCP stdio test endpoints
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration i...
LiteLLM 命令注入漏洞
LiteLLM is an open-source application developed by Berri AI. It can utilize all LLM APIs in the OpenAI format. Versions of LiteLLM from 1.74.2 to 1.83.7 contained a command injection vulnerability. This vulnerability stemmed from two endpoints used for previewing the MCP server accepting complete...
LiteLLM 安全漏洞
LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. Versions of LiteLLM from 1.80.5 to 1.83.7 contained a security vulnerability. This vulnerability stemmed from the POST /prompts/test endpoint accepting user-provided...
CVE-2026-42203 vulnerabilities
Vulnerabilities for packages: litellm, airflow...
CVE-2026-41314 vulnerabilities
Vulnerabilities for packages: nemo, open-webui, litellm...
CVE-2026-42271 vulnerabilities
Vulnerabilities for packages: litellm, airflow...
CVE-2026-41168 vulnerabilities
Vulnerabilities for packages: nemo, open-webui, litellm...
CVE-2026-42208 vulnerabilities
Vulnerabilities for packages: litellm, airflow...
CVE-2026-41312 vulnerabilities
Vulnerabilities for packages: nemo, open-webui, litellm...
CVE-2026-41313 vulnerabilities
Vulnerabilities for packages: nemo, open-webui, litellm...