Executive brief
LiteLLM is an open-source LLM proxy that provides API access to over 100 language model providers. The guardrails feature allows administrators to define custom Python code to filter LLM requests and responses. An authenticated attacker can bypass the sandbox restrictions using bytecode rewriting techniques to execute arbitrary code on the server, potentially compromising the entire deployment.
Technical details
This vulnerability is a code injection / sandbox escape in the /guardrails/test_custom_code API endpoint. The endpoint accepts Python source code for guardrail testing and attempts to restrict dangerous operations using regex-based filtering of the source code. However, the regex filter operates only at the syntax level and can be bypassed through string concatenation to obfuscate blocked identifiers (e.g., "__globals__" → "_"+"_gl"+"ob"+"als"+"_"+"_") combined with CPython bytecode rewriting via the code.replace() method. An authenticated attacker can craft a payload that rewrites bytecode to access the __import__ function and execute arbitrary system commands. The attack requires HTTP POST access to the API and valid authentication (master key), but no user interaction. The vulnerability affects LiteLLM versions 1.81.8 through 1.83.9, with patches available in version 1.83.10 and later.
Affected products
- BerriAI LiteLLM 1.81.8 through 1.83.9
Timeline
- 2026-04-10: disclosed: Public disclosure via GHSA and X41 D-Sec advisory
- 2026-04-08: patched: Patches available in version 1.83.10 and later
- 2026-05-11: other: GHSA advisory withdrawn as duplicate