AIKIDO-2026-530037
litellm is vulnerable to OS Command Injection
87
High Risk
This Affects:
litellmTL;DR
The LiteLLM proxy MCP server management feature lets users register MCP servers using the stdio transport, supplying a command and args. Those values are passed straight to StdioServerParameters and executed as a subprocess on the proxy host without validation, so an authenticated user able to create or test a stdio MCP server can run arbitrary operating-system commands with the privileges of the LiteLLM process. The /mcp-rest/test/* endpoints made this reachable without administrator role. The fix adds a command allowlist, enforces it at the Pydantic model and at stdio client instantiation, and restricts the preview/test endpoints to the proxy admin role.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the LiteLLM proxy with MCP server management enabled where authenticated users can create or test stdio-transport MCP servers.
Background info
litellm is vulnerable to OS Command Injection in versions 1.74.3 - 1.83.5.
How to fix this
Upgrade the litellm library to the patch version.
Links
GitHub Release
Other
docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
github.com/BerriAI/litellmox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.