CVE-2026-30623 Scanner

LiteLLM is a lightweight library commonly used for language model management and computation, mainly in machine learning and AI environments. Developed to facilitate easier manipulation and deployment of machine learning models, LiteLLM is often implemented by data scientists and engineers in various industries. The software provides tools for handling language models more efficiently, enabling integration into larger AI systems. It is particularly favored in environments where computational efficiency is prioritized. Organizations involved in AI development and research frequently utilize LiteLLM for its capabilities in enhancing natural language processing tasks. Given its wide usage and integration capabilities, maintaining LiteLLM's security integrity is vital for protecting infrastructure and sensitive data.

Command Injection is a critical vulnerability that allows attackers to execute arbitrary commands on a host operating system via vulnerable software. This vulnerability arises due to insufficient validation of input data, which leads to unintended command execution. In LiteLLM 1.18.10, the vulnerability is triggered through improper validation within the MCP server creation process. An attacker could exploit this to execute commands with the same privileges as the running LiteLLM process. The existence of this vulnerability poses significant risks, potentially allowing full system compromise if exploited. Addressing this issue is crucial to maintaining the security and reliability of environments utilizing LiteLLM.

The vulnerability in LiteLLM 1.18.10 exploits the lack of proper validation in the MCP server creation. The attacker sends a crafted JSON payload containing arbitrary commands through HTTP requests to specific endpoints. By manipulating parameters such as 'command' and 'args', an attacker can remotely execute system commands. The template uses POST requests to the path '/mcp-rest/test/connection' to deliver the payload. Proper response codes and response time are monitored to confirm the success of the exploit, indicating a potential security breach. The primary focus is on endpoints handling JSON configurations vulnerable to command injection.

Exploitation of this vulnerability could lead to severe consequences, including remote code execution with privileges of the LiteLLM process. This may result in unauthorized access to sensitive data, disruption of services, or further propagation of malicious activities within a compromised environment. Attackers may fully control affected systems, altering data, deploying malware, or using systems for additional attacks. Financial, reputational, and operational damages are likely outcomes, emphasizing the importance of implementing security measures promptly. Organizations must remain vigilant and proactive in protecting systems against such vulnerabilities.

REFERENCES

• https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
• https://cveawg.mitre.org/api/cve/CVE-2026-30623
• https://github.com/BerriAI/litellm