{"id":"CVE-2026-40217","aliases":["GHSA-wxxx-gvqv-xp7p","PYSEC-2026-2601"],"title":"LiteLLM has a sandbox escape in custom-code guardrail","summary":"LiteLLM has a sandbox escape in custom-code guardrail","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"litellm","product":"litellm","ecosystem":"pip","affected":["litellm >= 1.81.8, < 1.83.10"],"patched":["litellm 1.83.10"],"published":"2026-05-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:07.231161323Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wxxx-gvqv-xp7p","references":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40217"},{"url":"https://github.com/BerriAI/litellm"},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm"}],"tags":["osv","pip","exploit-available"],"epss":0.15056,"epssPercentile":0.96629,"exploits":{"github":1,"githubRepos":["https://github.com/learner202649/CVE-2026-40217-PoC"],"nuclei":["CVE-2026-40217"],"checkedAt":"2026-09-21T15:28:49.914Z"},"exploitAvailable":true,"ingestedAt":"2026-07-13T18:58:04.786Z","slug":"CVE-2026-40217","body":"## Overview\n\n### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)\n\n## Affected packages\n\n- `litellm >= 1.81.8, < 1.83.10`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `litellm 1.83.10`","depth":"midnight","depthScore":63,"depthScoreParts":{"impact":48.4,"likelihood":3,"exploitation":12,"ransomware":0},"changes":[{"seq":5167,"id":"CVE-2026-40217","ts":1788887251382,"field":"exploit_available","old":"false","new":"true"},{"seq":4050,"id":"CVE-2026-40217","ts":1788886367306,"field":"exploit_available","old":"true","new":"false"},{"seq":2843,"id":"CVE-2026-40217","ts":1788883033932,"field":"exploit_available","old":"false","new":"true"},{"seq":1872,"id":"CVE-2026-40217","ts":1788882436839,"field":"exploit_available","old":"true","new":"false"},{"seq":970,"id":"CVE-2026-40217","ts":1788881871122,"field":"exploit_available","old":"false","new":"true"},{"seq":188,"id":"CVE-2026-40217","ts":1787690230726,"field":"epss","old":"0.06496","new":"0.15056"}]}