PYSEC-2026-2601
LiteLLM has a sandbox escape in custom-code guardrail
At a glance
- Published
- Updated
- CVE
- CVE-2026-40217
- Aliases
- GHSA-wxxx-gvqv-xp7p
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
### Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. **Reaching the endpoint requires a proxy-admin credential** in default configurations. ### Patches Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. ### Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. ### References - Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)
Affected packages
| Package | Versions |
|---|---|
| PyPI · litellm | introduced 1.81.8, fixed 1.83.10 |
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-40217 ADVISORY
- https://github.com/BerriAI/litellm PACKAGE
- https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable WEB
- https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm WEB
- https://pypi.org/project/litellm PACKAGE
- https://github.com/advisories/GHSA-wxxx-gvqv-xp7p ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |