Executive brief
LiteLLM, a tool used to manage and proxy various AI models, contains a vulnerability in its 'Custom Code Guardrails' feature. This flaw allows users with administrative access to bypass security sandboxing and execute arbitrary Python code on the server. If a master key is not configured, even non-administrative users might be able to exploit this, potentially leading to the theft of sensitive API keys and service disruption.
Technical details
A code injection vulnerability exists in LiteLLM's production endpoints for creating and updating Custom Code Guardrails (POST /guardrails and PUT /guardrails/{guardrail_id}). Unlike the test endpoint, these production paths failed to apply proper sandboxing and validation to user-submitted Python code. An attacker with administrative privileges—or a standard user in deployments where LITELLM_MASTER_KEY is not set—can execute arbitrary Python code within the LiteLLM proxy container. This can lead to full container compromise and the exposure of environment variables and secrets. The issue is resolved in version 1.82.0-stable.
Affected products
- BerriAI litellm < 1.82.0
Timeline
- 2026-06-30: disclosed: Initial disclosure by reporter
- 2026-07-08: advisory: NVD publication
- 2026-07-22: advisory: GitHub Advisory published