A lapse in input validation allows an authenticated user to supply arbitrary command, arguments, and environment variables to a proxy server’s pre‑connection test endpoints. When the server attempts a stdio transport connection, those values are passed to the operating system as a subprocess, enabling the attacker to execute any command with the proxy process’s privileges. This flaw is a classic command injection that can compromise confidentiality, integrity, and availability of the host. The CVE notes a CVSS score of 8.7, indicating a high severity and significant risk if exploited.

The issue affects BerriAI’s LiteLLM product, versions 1.74.2 through the pre‑1.83.7 releases. Any installation deploying a pre‑patched LiteLLM instance and using its authentication system is vulnerable; the flaw is contained to the preview endpoints used for Microsoft Cloud Platform (MCP) server configuration previews.

The vulnerability is accessible only to users possessing a valid proxy API key, yet no role or privilege check is performed. Because the endpoints accept full configuration payloads, an attacker can choose any command, bypassing typical operational constraints. The patch to version 1.83.7 resolves the injection, so the attack vector disappears once upgraded. The lack of an EPSS score and absence from the KEV list suggests no widely known exploits yet, but the high CVSS score signals a serious potential threat landscape.