CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
How it works
The weakness falls under CWE-78 and CWE-77, both describing improper neutralization of special elements used in OS commands. An attacker supplies crafted input through an authenticated session; the application incorporates that input into a command string executed by the host operating system without adequate validation or escaping.
Because the injection occurs after authentication, even accounts with limited intended privileges can trigger execution of attacker-chosen commands on the underlying host.
Am I affected? How to find it in your systems
Locate all instances of BerriAI LiteLLM in your environment, including any containerized or cloud-hosted deployments. Inventory the software versions and the authentication mechanisms in use, paying particular attention to internal-user keys or other low-privilege credentials.
- Review application configuration files and environment variables that control command execution or external process invocation.
- Examine authentication and request logs for patterns of unexpected parameter values or repeated calls from the same low-privilege accounts.
- Confirm exact affected versions and configurations against the vendor advisory, as public detail is limited.
How to remediate
Apply mitigations per the vendor instructions. Where a software update is provided, install it on all affected instances before re-enabling external access.
- Review and restrict the set of authenticated users or keys that can reach command-related endpoints.
- Validate that input handling follows secure coding practices for the command-injection weakness class.
- Follow applicable BOD 22-01 guidance for any cloud services involved.
If you can't patch immediately
Place the affected systems behind network segmentation that limits inbound access to only trusted sources. Consider virtual patching through a web application firewall or reverse proxy that can inspect and block suspicious command-like patterns in requests.
- Disable or restrict features that accept unauthenticated or low-privilege input until remediation is complete.
- Increase monitoring of process creation and command-line activity on hosts running the software.
- Discontinue use of the product if no mitigations can be applied.
If your data may have been exposed
Command injection vulnerabilities that permit arbitrary host commands have led to system compromise in other cases. You can run a free exposure scan of your email addresses to check against known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.