An authenticated remote code execution vulnerability in LiteLLM allows users with the PROXY_ADMIN role to execute arbitrary commands by injecting malicious JSON configurations.

The vulnerability exists in the MCP server creation functionality, where the application fails to validate arbitrary command and argument values provided in JSON configurations. Exploitation requires the attacker to possess a valid API key and hold the PROXY_ADMIN role, allowing them to execute code on the host.

The CVSS score of 9.8 highlights the critical impact of this vulnerability, as it allows an attacker with elevated privileges to achieve remote code execution. This could lead to full system takeover, unauthorized access to sensitive API keys, and potential exfiltration of data processed by the LiteLLM proxy.

Immediate Action: Update LiteLLM to version v1.83.6-nightly or v1.83.7-stable immediately to resolve the command injection vulnerability.

Proactive Monitoring: Audit existing LiteLLM configurations for any suspicious MCP server entries and review logs for commands executed via the proxy admin interface.

Compensating Controls: Apply the principle of least privilege by strictly limiting the number of users assigned the PROXY_ADMIN role and ensuring the application is hosted in a restricted environment.

Public Exploit Available: No

Administrators should prioritize upgrading to the patched versions of LiteLLM to eliminate this command injection risk. Furthermore, strictly control access to administrative roles to prevent unauthorized users from leveraging this functionality for malicious purposes.