Executive brief
LiteLLM is a proxy server used to connect various Artificial Intelligence models through a single interface. A security flaw in its 'guardrails' feature allows an authorized user to bypass safety restrictions and run malicious code on the server. This could lead to a complete takeover of the server, potentially exposing sensitive API keys or customer data.
Technical details
A sandbox escape exists in LiteLLM's /guardrails/test_custom_code endpoint due to insufficient validation of user-supplied Python code. While the application uses regex-based filtering to block dangerous keywords (e.g., __globals__, __import__), an attacker can bypass these checks using string concatenation and CPython bytecode manipulation (specifically using code.replace and gi_code). By rewriting the bytecode's name table at runtime, an attacker can access restricted built-in functions and achieve arbitrary code execution. In default Docker deployments, this results in remote code execution as the root user. The vulnerability requires authentication with a valid master key or administrative credentials.
Affected products
- BerriAI litellm >= 1.81.8, < 1.83.10
Timeline
- 2026-02-13: other: Vulnerability identified and PoC created by X41 D-Sec
- 2026-04-08: disclosed: Public disclosure by X41 D-Sec after embargo expiration
- 2026-04-10: advisory: GitHub Advisory published
- 2026-05-11: patched: Advisory updated with patched version 1.83.10