CVE-2026-40217High· 8.8▾ MidnightPoC availableLiteLLM has a sandbox escape in custom-code guardrail
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
6.5%
6.5% → 15%
1 GitHub repo · Nuclei ×1
Last analysed / modified upstream
The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.
Reaching the endpoint requires a proxy-admin credential in default configurations.
Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.
If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.
v1.83.10-stablelitellm >= 1.81.8, < 1.83.10Upgrade to a patched release:
litellm 1.83.10Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47102High· 8.8LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint
CVE-2026-59819Medium· 4.9LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2026-42203HighLiteLLM: Server-Side Template Injection in /prompts/test endpoint
CVE-2026-35029HighLiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
CVE-2026-59822High· 8.2LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2024-4890Medium· 4.9SQL injection in litellm