LiteLLM version 1.18.10 contains a flaw in its MCP server creation routine that accepts arbitrary command and argument values from a JSON configuration. The application executes these values on the host without any validation, allowing an attacker to run any operating system command with the privileges of the LiteLLM process. This results in full remote code execution, giving the attacker control over the underlying host.

The vulnerability affects LiteLLM, automatically adding MCP servers via JSON configuration. Only the 1.18.10 release is documented as vulnerable; earlier releases are not known to contain this issue.

The CVSS score of 9.8 indicates critical severity. The EPSS score is 6%, suggesting that, while exploitation is not common, it is technically possible and could be achieved if an attacker gains access to the configuration interface. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported, but the nature of the flaw allows arbitrary command execution with no additional preconditions beyond the ability to submit a JSON configuration to LiteLLM.