https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:43:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-40217 <p><strong>Affected:</strong> BerriAI LiteLLM, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Lightspeed Core, Red Hat OpenShift AI (RHOAI)</p> <p>LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.</p> <p><strong>Affected:</strong> BerriAI LiteLLM, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Lightspeed Core, Red Hat OpenShift AI (RHOAI)</p> <p>LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.</p> https://vulnerability.circl.lu/vuln/cve-2026-40217 https://vulnerability.circl.lu/vuln/ghsa-wxxx-gvqv-xp7p <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.</p> <p>**Reaching the endpoint requires a proxy-admin credential** in default configurations.</p> <p>### Patches</p> <p>Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.</p> <p>### References</p> <p>- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)</p> <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.</p> <p>**Reaching the endpoint requires a proxy-admin credential** in default configurations.</p> <p>### Patches</p> <p>Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.</p> <p>### References</p> <p>- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)</p> https://vulnerability.circl.lu/vuln/ghsa-wxxx-gvqv-xp7p https://vulnerability.circl.lu/vuln/pysec-2026-2601 <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.</p> <p>**Reaching the endpoint requires a proxy-admin credential** in default configurations.</p> <p>### Patches</p> <p>Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.</p> <p>### References</p> <p>- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)</p> <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.</p> <p>**Reaching the endpoint requires a proxy-admin credential** in default configurations.</p> <p>### Patches</p> <p>Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.</p> <p>### References</p> <p>- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)</p> https://vulnerability.circl.lu/vuln/pysec-2026-2601