AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LiteLLMGHSA-wxxx-gvqv-xp7p

LiteLLM has a sandbox escape in custom-code guardrail

LiteLLM

CVE-2026-40217 · Published May 11, 2026 · updated Sep 10, 2026

High8.8
Fix: upgrade to 1.83.10 or later
GitHub advisory

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process , which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in **1.83.11**. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

  • Patched release: [v1.83.10-stable](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)

Affected versions

PackageAffectedFixed in
litellm
PyPI
>= 1.81.8, < 1.83.101.83.10
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-420, CWE-913
Also known as
CVE-2026-40217, PYSEC-2026-2601

More LiteLLM advisories

All LiteLLM
High 8.8May 21LiteLLM allows a user to modify their own user_role via the /user/update endpointCVE-2026-47102fixed in 1.83.10High 8.8May 21LiteLLM: privilege escalationCVE-2026-47101fixed in 1.83.14High 8.8Apr 25LiteLLM: Authenticated command execution via MCP stdio test endpointsCVE-2026-42271fixed in 1.83.7Critical 9.8Apr 24LiteLLM has SQL Injection in Proxy API key verificationCVE-2026-42208fixed in 1.83.7HighApr 24LiteLLM: Server-Side Template Injection in /prompts/test endpointCVE-2026-42203fixed in 1.83.7HighApr 8LiteLLM: Password hash exposure and pass-the-hash authentication bypassGHSA-69x8-hrgq-fjj8fixed in 1.83.0