Authenticated server-side template injection in LiteLLM Proxy

This repository is a small, self-contained proof-of-concept exploit for CVE-2026-42203 affecting LiteLLM's /prompts/test functionality. The main exploit logic is in CVE_2026_42203.py, a Python script that builds a malicious dotprompt payload containing a Jinja SSTI expression: it reaches into cycler.__init__.__globals__.os and invokes os.popen() to execute a command on the target. The executed command is a Python one-liner that performs an HTTP request to a randomized CEYE subdomain, allowing blind confirmation of remote code execution through an out-of-band callback. Operational flow: the script accepts a target URL, LiteLLM API key, CEYE token, and CEYE domain; generates a random filter string; constructs callback URL http://<random>.<ceye-domain>/; embeds that into the SSTI payload; sends the payload to POST /prompts/test with Bearer authentication; then polls http://api.ceye.io/v1/records until the callback appears or a timeout expires. Exit codes distinguish vulnerable, not vulnerable, configuration error, and inconclusive states. Repository structure is minimal: one Python exploit, one README with usage instructions, and a Lab directory containing docker-compose.yaml plus litellm_config.yaml to reproduce a local vulnerable environment. The lab deploys PostgreSQL and LiteLLM on port 4000, with a sample master key and config mount. This is not merely a detector: it attempts actual code execution on the target, but the payload is fixed to an outbound HTTP callback rather than an interactive shell, so OPERATIONAL is the best maturity fit rather than WEAPONIZED.