Every CVE Search/ Get API key

CVE-2026-40217

Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail

8.8 HighPublic exploitFix available

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

17.0%Up 16.8 points since Apr 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Record
CVE-2026-40217
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420, CWE-94
Updated
2026-11-02
EUVDEUVD-2026-21376 8.8

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Record
EUVD-2026-21376
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3926-2jvf-fg29 8.8

Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wxxx-gvqv-xp7p. This link is maintained to preserve external references.

Original Description

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Record
GHSA-3926-2jvf-fg29
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02
GitHub AdvisoriesGHSA-wxxx-gvqv-xp7p 7.5

LiteLLM has a sandbox escape in custom-code guardrail

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

Record
GHSA-wxxx-gvqv-xp7p
CVSS 4.0
7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420, CWE-913
Updated
2026-11-02
NVD 8.8

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Record
CVE-2026-40217
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420, CWE-94
Updated
2026-11-02
OSVGHSA-3926-2jvf-fg29 8.8

Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wxxx-gvqv-xp7p. This link is maintained to preserve external references.

Original Description

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Record
GHSA-3926-2jvf-fg29
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420
Updated
2026-11-02
OSVGHSA-wxxx-gvqv-xp7p 7.5

LiteLLM has a sandbox escape in custom-code guardrail

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

Record
GHSA-wxxx-gvqv-xp7p
CVSS 4.0
7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-420, CWE-913
Updated
2026-11-02
OSVPYSEC-2026-2601 7.5

LiteLLM has a sandbox escape in custom-code guardrail

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

Record
PYSEC-2026-2601
CVSS 4.0
7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
litellm
PyPI
 1.81.8 up to 1.83.10
1.83.10
litellm
PyPI
 1.81.8 up to 1.83.10, plus listed versions
1.81.101.81.111.81.121.81.131.81.14
Show 21 moreShow less
1.81.151.81.161.81.91.81.9.dev11.82.01.82.11.82.21.82.31.82.41.82.51.82.61.83.01.83.11.83.21.83.31.83.41.83.51.83.61.83.71.83.81.83.9
1.83.10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHublearner202649/CVE-2026-40217-PoC2026-05-19
NucleiLiteLLM < 1.25.0 - Remote Code Execution

History

History
RecordedChangedSources
affected, exploits
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40217 is a high vulnerability (CVSS 8.8) in Berriai Litellm, published April 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.0%, the 97th percentile. Fixed in litellm 1.83.10.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open