{"id":"CVE-2026-40217","aliases":["EUVD-2026-21376","GHSA-3926-2jvf-fg29","GHSA-wxxx-gvqv-xp7p","PYSEC-2026-2601"],"status":"published","title":"Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail","description":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.1702,"percentile":0.97095,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-420","CWE-913","CWE-94"],"published":"2026-04-10T13:43:23Z","modified":"2026-10-26T21:10:00Z","exploits":[{"source":"pocgithub","id":"learner202649/CVE-2026-40217-PoC","title":"learner202649/CVE-2026-40217-PoC","date":"2026-05-19","url":"https://github.com/learner202649/CVE-2026-40217-PoC"},{"source":"nuclei","id":"CVE-2026-40217","title":"LiteLLM \u003c 1.25.0 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40217.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"litellm","fixed_in":["1.83.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"litellm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.81.8"},{"fixed":"1.83.10"}]}]},{"source":"osv","ecosystem":"PyPI","package":"litellm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.81.8"},{"fixed":"1.83.10"}]}],"versions":["1.81.10","1.81.11","1.81.12","1.81.13","1.81.14","1.81.15","1.81.16","1.81.8","1.81.9","1.81.9.dev1","1.82.0","1.82.1","1.82.2","1.82.3","1.82.4","1.82.5","1.82.6","1.83.0","1.83.1","1.83.2","1.83.3","1.83.4","1.83.5","1.83.6","1.83.7","1.83.8","1.83.9"]},{"source":"osv","ecosystem":"PyPI","package":"litellm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.81.8"},{"fixed":"1.83.10"}]}],"versions":["1.81.10","1.81.11","1.81.12","1.81.13","1.81.14","1.81.15","1.81.16","1.81.8","1.81.9","1.81.9.dev1","1.82.0","1.82.1","1.82.2","1.82.3","1.82.4","1.82.5","1.82.6","1.83.0","1.83.1","1.83.2","1.83.3","1.83.4","1.83.5","1.83.6","1.83.7","1.83.8","1.83.9"]}],"products":[{"vendor":"berriai","product":"litellm"},{"vendor":"litellm","product":"litellm"},{"vendor":"red hat","product":"lightspeed core"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.3"}],"references":[{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40217","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457301","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40217.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30056","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40217","tags":["advisory"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3926-2jvf-fg29"},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p","tags":["web"]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wxxx-gvqv-xp7p","tags":["advisory"]},{"url":"https://github.com/BerriAI/litellm","tags":["package"]},{"url":"https://pypi.org/project/litellm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40217","description":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","status":"published","published":"2026-04-10T13:43:23.147Z","modified":"2026-07-15T01:01:14.184Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-420","CWE-94"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-21376","description":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","status":"published","published":"2026-04-10T13:43:23Z","modified":"2026-07-15T01:01:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-3926-2jvf-fg29","title":"Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wxxx-gvqv-xp7p. This link is maintained to preserve external references.\n\n### Original Description\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","status":"withdrawn","published":"2026-04-10T15:31:57Z","modified":"2026-05-11T16:17:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-wxxx-gvqv-xp7p","title":"LiteLLM has a sandbox escape in custom-code guardrail","description":"### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)","status":"published","published":"2026-05-11T16:17:23Z","modified":"2026-05-11T16:17:23Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-420","CWE-913"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-40217","description":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","status":"published","published":"2026-04-10T14:16:36.307Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-420","CWE-94"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"GHSA-3926-2jvf-fg29","title":"Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-wxxx-gvqv-xp7p. This link is maintained to preserve external references.\n\n### Original Description\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","status":"withdrawn","published":"2026-04-10T15:31:57Z","modified":"2026-09-10T03:50:42.400448144Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-wxxx-gvqv-xp7p","title":"LiteLLM has a sandbox escape in custom-code guardrail","description":"### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)","status":"published","published":"2026-05-11T16:17:23Z","modified":"2026-09-10T03:51:07.231161323Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-420","CWE-913"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"PYSEC-2026-2601","title":"LiteLLM has a sandbox escape in custom-code guardrail","description":"### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)","status":"published","published":"2026-07-13T15:15:44.44332Z","modified":"2026-07-13T16:32:04.565604725Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}