Most recent entries from all

CVE-2026-40217

2026-09-30T03:55:44.035601+00:00

Affected: BerriAI LiteLLM, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Lightspeed Core, Red Hat OpenShift AI (RHOAI)

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

GHSA-wxxx-gvqv-xp7p — LiteLLM has a sandbox escape in custom-code guardrail

2026-09-30T03:55:44.035715+00:00

Affected: PyPI: litellm

### Impact

The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

**Reaching the endpoint requires a proxy-admin credential** in default configurations.

### Patches

Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.

### Workarounds

If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.

### References

- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)

PYSEC-2026-2601 — LiteLLM has a sandbox escape in custom-code guardrail

2026-09-30T03:55:44.035787+00:00