GitHub Advisoryadvisory · PyPI

GHSA-wxxx-gvqv-xp7p LiteLLM has a sandbox escape in custom-code guardrail

HIGH Published 2026-05-11 Modified 2026-05-11 Official page ↗
Aliases
CVE-2026-40217
Ecosystem
PyPI
Packages
litellm
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-420, CWE-913
Reviewed
2026-05-11

Affected packages

• PyPI litellm: >= 1.81.8, < 1.83.10 → fixed in 1.83.10

Description

Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. Reaching the endpoint requires a proxy-admin credential in default configurations. Patches Fixed in `1.83.11`. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. References • Patched release: `v1.83.10-stable`

Related

Alias · CVE (1)

  • CVE-2026-40217 LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. vulnerability

Weakness · CWE (2)

  • CWE-420 Unprotected Alternate Channel weakness
  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness

References