Command injection in LiteLLM, an LLM proxy (CVE-2026-42271) — even low-privilege users can run arbitrary commands on the host

CVE-2026-42271 is a command-injection vulnerability (CWE-78: improper neutralization of OS commands / CWE-77: command injection) in BerriAI LiteLLM (a popular open-source LLM proxy/gateway that unifies access to many LLM providers behind a single interface). It was added to CISA's KEV catalog on June 8, 2026.

Per NVD, any authenticated user — including holders of low-privilege internal-user keys — can run arbitrary commands on the host running LiteLLM. Although authentication is a prerequisite, proxies like LiteLLM are often shared by distributing keys to many users, so the fact that even a low-privilege key can take over the host is serious. Arbitrary command execution on the host can lead to theft of the API keys and tokens the proxy manages for each LLM provider, and to a foothold for further intrusion.

It follows the LiteLLM SQL injection (CVE-2026-42208) already covered on this site — another vulnerability targeting AI infrastructure (the platform that runs and relays LLMs). It shows that the software underpinning AI is being repeatedly exploited.

Key response: apply fixes/mitigations per the vendor instructions. For cloud use, follow BOD 22-01, and discontinue use if mitigations are unavailable. Rotate the API keys and tokens LiteLLM manages on the assumption of leakage, and review the privileges and distribution of internal-user keys. The federal civilian remediation deadline was June 22, 2026.