LiteLLM: LiteLLM has a sandbox escape in custom-code guardrail
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-40217
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 11, 2026
- Source last modified
- May 11, 2026
Description
Impact
The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.
Reaching the endpoint requires a proxy-admin credential in default configurations.
Patches
Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.
Workarounds
If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.
References
- Patched release: [v1.83.10-stable](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a tool that sits between your organization's apps and AI language model services. This flaw affects LiteLLM versions before 1.83.11, in the feature that lets administrators test custom code for guardrails (safety rules that check what goes to and from the AI). That feature runs the code in a walled-off area meant to contain it, but an attacker can break out and run any code they choose on the server running LiteLLM. In the default Docker setup, that code gets full administrator control. An attacker needs a LiteLLM admin login in default setups. This flaw is rated High.
What to do
- The person who installed or runs LiteLLM for your organization should act on this flaw.
- Upgrade LiteLLM to
1.83.11or later, which fixes this flaw. - If upgrading is not immediately possible, block access to the custom-code guardrail test feature at your reverse proxy or API gateway (the front-door system that screens web requests before they reach LiteLLM).
- If an IT provider or vendor runs LiteLLM for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of May 11, 2026 and reviewed before publishing.