LiteLLM is a proxy server for calling LLM APIs. Versions from 1.74.2 to before 1.83.7 contain a command injection vulnerability in the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints. These endpoints accept a full server configuration including command, args, and env fields used by the stdio transport. When a stdio configuration is provided, the server spawns the supplied command as a subprocess with the proxy process privileges. The endpoints require only a valid proxy API key without role checks, allowing any authenticated user, including those with low-privilege internal-user keys, to execute arbitrary commands on the host. The vulnerability is fixed in version 1.83.7.

An attacker with any valid proxy API key, including low-privilege keys, can execute arbitrary commands on the proxy host with the privileges of the proxy process. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in LiteLLM version 1.83.7. Users should upgrade to version 1.83.7 or later to remediate this vulnerability. There is no indication that temporary mitigations or workarounds are provided by the vendor. Review and restrict API key usage to minimize exposure until patching is complete.