{"id":"PYSEC-2026-2601","summary":"LiteLLM has a sandbox escape in custom-code guardrail","details":"### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)","aliases":["CVE-2026-40217","GHSA-wxxx-gvqv-xp7p"],"modified":"2026-07-13T16:32:04.565604725Z","published":"2026-07-13T15:15:44.443320Z","references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40217"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"},{"type":"WEB","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm"},{"type":"PACKAGE","url":"https://pypi.org/project/litellm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wxxx-gvqv-xp7p"}],"affected":[{"package":{"name":"litellm","ecosystem":"PyPI","purl":"pkg:pypi/litellm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.81.8"},{"fixed":"1.83.10"}]}],"versions":["1.81.10","1.81.11","1.81.12","1.81.13","1.81.14","1.81.15","1.81.16","1.81.8","1.81.9","1.81.9.dev1","1.82.0","1.82.1","1.82.2","1.82.3","1.82.4","1.82.5","1.82.6","1.83.0","1.83.1","1.83.2","1.83.3","1.83.4","1.83.5","1.83.6","1.83.7","1.83.8","1.83.9"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/litellm/PYSEC-2026-2601.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}