CVE-2026-30623

CRITICAL

LiteLLM 1.18.10 - Remote Code Execution via MCP Server Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-30623. PoCs published by csinexus.

AI-analyzed exploit summary This repository provides a drop-in Python mitigation for CVE-2026-30623, a command injection vulnerability in the MCP SDK's STDIO transport. The exploit patch validates and sanitizes command, argument, and environment variables before process spawning, blocking unsafe configurations while allowing legitimate MCP server launches.

Description

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

Exploits (1)

nomisec WORKING POC

by csinexus · poc

https://github.com/csinexus/mcpshield

View Code ZIP pw:eip

This repository provides a drop-in Python mitigation for CVE-2026-30623, a command injection vulnerability in the MCP SDK's STDIO transport. The exploit patch validates and sanitizes command, argument, and environment variables before process spawning, blocking unsafe configurations while allowing legitimate MCP server launches.

Classification

Working Poc 98%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: MCP SDK (Python/TypeScript/Java/Rust) versions vulnerable to CVE-2026-30623

No auth needed

Prerequisites: Ability to influence MCP server configuration (command/args/env) in a vulnerable application · Target application must use the MCP SDK's STDIO transport

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 21, 2026 Full analysis →

References (3)

Core 3

Core References

https://github.com/BerriAI/litellm

https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026

Scores

CVSS v3 9.8

EPSS 0.0167

EPSS Percentile 74.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-77

Status published

Published Jul 15, 2026

Tracked Since Jul 16, 2026