CVE-2026-31236: llm CLI Tool RCE Vulnerability

CVE-2026-31236 Overview

CVE-2026-31236 is a code injection vulnerability in the llm CLI tool through version 0.27.1. The tool accepts custom Python function definitions via the --functions command-line argument and passes them directly to Python's exec() function without sanitization, sandboxing, or any security restrictions. An attacker who convinces a victim to run a crafted llm command achieves arbitrary code execution on the target system. The flaw maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation grants the attacker full code execution under the victim's user context, enabling credential theft, data exfiltration, and persistent system compromise.

Affected Products

llm CLI tool versions up to and including 0.27.1
Python environments where the llm package is installed and invoked
Developer and AI-engineering workstations using llm for model interaction

Discovery Timeline

2026-05-12 - CVE-2026-31236 published to the National Vulnerability Database
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-31236

Vulnerability Analysis

The llm CLI tool exposes a --functions argument designed to let users register custom Python callables for use during model interactions. The implementation reads the user-supplied string and forwards it directly to Python's built-in exec() primitive. Because exec() evaluates arbitrary Python source in the current process, any code placed inside the argument runs with the full privileges of the invoking user.

The tool performs no input validation, no abstract syntax tree inspection, and no sandbox isolation. There is no allowlist of permitted function definitions and no restricted execution context. This makes the argument a direct gateway to arbitrary command execution rather than a constrained function-definition slot.

The vulnerability is categorized as [CWE-94] code injection. Exploitation requires the victim to execute an attacker-supplied command line, which is typically delivered through social engineering, tutorial content, or copy-paste workflows common in AI tooling ecosystems.

Root Cause

The root cause is the unsafe use of exec() on untrusted input. The argument parser treats the --functions value as trusted Python source and executes it in the main interpreter scope. No parsing, scoping, or capability restriction separates legitimate function definitions from arbitrary statements such as import os; os.system(...).

Attack Vector

An attacker crafts a malicious one-liner that appears to be a benign llm invocation. The --functions payload contains Python statements that perform file reads, network callbacks, or shell command execution. The attacker then distributes the command through blog posts, social media, README files, or chat messages targeting developers and AI practitioners.

When the victim runs the command, the malicious payload executes immediately, before any model interaction takes place. The attack requires no authentication, no privileged access, and no additional vulnerability chaining. See the llm project repository for tool behavior and the CVE-2026-31236 analysis notes for further context.

Detection Methods for CVE-2026-31236

Indicators of Compromise

Shell history entries containing llm invocations with --functions arguments that include import, os.system, subprocess, eval, exec, __import__, or open( calls
Child processes of llm spawning shells (sh, bash, cmd.exe, powershell.exe) or network utilities (curl, wget, nc)
Outbound network connections initiated by the Python interpreter hosting the llm process to unfamiliar hosts immediately after CLI execution
Unexpected file reads of credential stores (~/.aws/credentials, ~/.ssh/, ~/.netrc) by the llm process

Detection Strategies

Monitor command-line telemetry for the literal pattern llm --functions and inspect the argument content for Python statements beyond function definitions
Alert on python or llm parent processes that spawn interactive shells or remote-access utilities
Correlate llm execution events with new persistence artifacts such as cron entries, systemd units, or shell profile modifications

Monitoring Recommendations

Enable command-line argument logging on developer endpoints, including Windows Event ID 4688 with command-line capture and Linux auditd execve rules
Baseline normal llm usage patterns and flag invocations whose --functions payload length or syntax deviates from established norms
Track installations of the llm package across managed endpoints to identify which hosts are exposed to the vulnerable versions

How to Mitigate CVE-2026-31236

Immediate Actions Required

Inventory all systems with the llm CLI installed and identify versions at or below 0.27.1
Restrict use of the --functions argument until a fixed release is verified, and prohibit copying llm commands from untrusted sources
Educate developers and AI engineers on the risk of pasting unvetted CLI commands containing --functions payloads

Patch Information

At the time of publication, no specific fixed version is referenced in the NVD record beyond the statement that versions through 0.27.1 are affected. Monitor the llm project repository for an upstream patch and upgrade to the first release that constrains --functions parsing or replaces exec() with a safer mechanism.

Workarounds

Wrap llm execution in a non-privileged service account or container with no access to credentials, SSH keys, or sensitive file paths
Use shell aliases or wrapper scripts that reject --functions arguments containing statements other than def definitions
Apply application allowlisting to prevent the Python interpreter invoked by llm from spawning shells or network utilities
Run llm inside an ephemeral sandbox such as a disposable virtual machine or rootless container when custom function definitions are required

bash

# Example wrapper that blocks --functions until a fixed release is deployed
#!/usr/bin/env bash
for arg in "$@"; do
  if [[ "$arg" == "--functions" || "$arg" == --functions=* ]]; then
    echo "Blocked: --functions is disabled pending CVE-2026-31236 remediation" >&2
    exit 1
  fi
done
exec /usr/local/bin/llm.real "$@"