CVE-2026-40217: Code Injection
Impact
The POST /guardrails/testcustomcode endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.
Reaching the endpoint requires a proxy-admin credential in default configurations.
Patches
Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.
Workarounds
If upgrading is not immediately possible, block POST /guardrails/testcustomcode at your reverse proxy or API gateway.
References
- Patched release: v1.83.10-stable
Other sources
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/testcustomcode URI.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.83.10 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.83.11 - Compensating control
If upgrading is not immediately possible, block the endpoint `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40217?
CVE-2026-40217 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2026-40217?
To fix CVE-2026-40217, update LiteLLM to the latest version released after April 8, 2026.
What does CVE-2026-40217 affect?
CVE-2026-40217 affects all versions of LiteLLM up to and including 2026-04-08.
Can CVE-2026-40217 be exploited remotely?
Yes, CVE-2026-40217 can be exploited remotely through bytecode rewriting at a specific URI.
What is the impact of CVE-2026-40217?
The impact of CVE-2026-40217 is the execution of arbitrary code by remote attackers.