Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2026-40217: LiteLLM has a sandbox escape in custom-code guardrail

highCVSS 4.0 7.5 · 3.1 8.8GHSA-wxxx-gvqv-xp7p

Impact The POST /guardrails/testcustomcode endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. Reaching the endpoint requires a proxy-admin credential in default configurations. Patches Fixed in 1.83.11.

Published May 11, 2026

Affected packages

litellm

Ecosystem
PyPI
Affected
>= 1.81.8, < 1.83.10
Fixed in
1.83.10
Check
pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in `1.83.11`. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries