LiteLLM has a sandbox escape in custom-code guardrail
High8.8CVE-2026-40217 · Published May 11, 2026 · updated Sep 10, 2026
### Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process , which runs as root in the default Docker image. **Reaching the endpoint requires a proxy-admin credential** in default configurations. ### Patches Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. ### Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. ### References - Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | >= 1.81.8, < 1.83.10 | 1.83.10 |
Details and references
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 21 | LiteLLM allows a user to modify their own user_role via the /user/update endpoint High8.8May 21 | High8.8 | 1.83.10 |
| May 21 | LiteLLM: privilege escalationHigh8.8May 21 | High8.8 | 1.83.14 |
| Apr 25 | LiteLLM: Authenticated command execution via MCP stdio test endpointsHigh8.8Apr 25 | High8.8 | 1.83.7 |
| Apr 24 | LiteLLM has SQL Injection in Proxy API key verificationCritical9.8Apr 24 | Critical9.8 | 1.83.7 |
| Apr 24 | LiteLLM: Server-Side Template Injection in /prompts/test endpointHighApr 24 | High | 1.83.7 |
| Apr 8 | LiteLLM: Password hash exposure and pass-the-hash authentication bypassHighApr 8 | High | 1.83.0 |