Command Injection in BerryAI LiteLLM (CVE‑2026‑42271) Enables Remote Code Execution – Active Exploits Confirmed

Command Injection in BerryAI LiteLLM (CVE‑2026‑42271) Enables Remote Code Execution – Active Exploits Confirmed by CISA

What It Is – An unauthenticated command‑injection flaw (CVE‑2026‑42271) in the open‑source LiteLLM AI gateway allows attackers to spawn arbitrary OS commands on the proxy host. The vulnerability stems from improper sanitisation of command, args, and env fields in two preview endpoints.

Exploitability – CISA has listed the flaw in its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. A proof‑of‑concept exists, and a chained bypass (CVE‑2026‑48710, “BadHost”) can remove the need for a valid API key. CVSS ≥ 9.0 (critical).

Affected Products – BerryAI LiteLLM library (versions < 1.83.7) and any deployments using LiteLLM as a standalone AI gateway or SDK integration. The underlying Starlette framework (pre‑v1.0.1) is also implicated.

TPRM Impact –

• Compromise of a third‑party AI gateway can expose downstream model provider credentials and corporate data.
• Attackers can pivot from the gateway to other internal services, creating a supply‑chain foothold.
• Organizations that rely on LiteLLM for cost‑control and vendor‑lock‑in avoidance face heightened risk of service disruption and data leakage.

Recommended Actions –

1. Immediately upgrade LiteLLM to v1.83.7 or later and Starlette to v1.0.1 or later.
2. Enforce role‑based access controls; only users with the PROXY_ADMIN role may call the vulnerable endpoints.
3. Rotate all API keys and secrets stored in the LiteLLM proxy.
4. Deploy network segmentation and monitoring for anomalous command‑execution activity on AI gateway hosts.
5. Review contracts with AI‑gateway providers for security‑by‑design clauses and incident‑response obligations.

Source: Help Net Security – LiteLLM vulnerability under active attack, CISA warns (CVE‑2026‑42271)