CVE-2026-40217

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.11

Description A flaw in the proxy server allows remote attackers to execute arbitrary code via bytecode rewriting. The issue exists because the POST /guardrails/test custom code endpoint runs user-supplied Python within a custom sandbox that can be escaped using bytecode-level techniques. This allows the execution of malicious code within the proxy process, which typically runs as root in the default Docker image. In default configurations, accessing this endpoint requires proxy-admin credentials.

Recommendations Update to version 1.83.11 or later. As a temporary workaround, block the POST /guardrails/test custom code endpoint at the reverse proxy or API gateway.