GHSA-wxxx-gvqv-xp7p CVE-2026-40217 PYSEC-2026-2601
LiteLLM has a sandbox escape in custom-code guardrail
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 15.53%
- Chance of exploitation in the next 30 days. Higher than 96.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-420 Unprotected Alternate Channel
- CWE-913 Improper Control of Dynamically-Managed Code Resources
- Fix
1.83.10- Upgrade litellm to this version or later
Description
Impact
The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.
Reaching the endpoint requires a proxy-admin credential in default configurations.
Patches
Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.
Workarounds
If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.
References
- Patched release:
v1.83.10-stable
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| litellm | >= 1.81.8, < 1.83.10 |
1.83.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
litellm PyPI → 1.83.10
- pip
pip install --upgrade "litellm>=1.83.10"- poetry
poetry add "litellm>=1.83.10"- uv
uv add "litellm>=1.83.10"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-420: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How to prevent it
- Architecture and Design: Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
How to prevent it
- Implementation: For any externally-influenced input, check the input against an allowlist of acceptable values.
- Implementation, Architecture and Design: Refactor the code so that it does not need to be dynamically managed.
References
Advisories
Packages
Other links
- github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p
- github.com/BerriAI/litellm/releases/tag/v1.83.10-stable
- x41-dsec.de/lab/advisories/x41-2026-001-litellm
- access.redhat.com/errata/RHSA-2026:24866
- access.redhat.com/errata/RHSA-2026:30056
- access.redhat.com/security/cve/CVE-2026-40217
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40217.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | High Known exploited | Also affects litellm |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints | High Known exploited | Also affects litellm |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification | Critical Known exploited | Also affects litellm |
| GHSA-g5ff-637f-6q2m LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` | High | Also affects litellm |
| GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback | Medium | Also affects litellm |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Critical | Also affects litellm |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | Medium | Also affects litellm |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | Medium | Also affects litellm |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor