---
id: CVE-2026-40217
aliases:
  - GHSA-wxxx-gvqv-xp7p
  - PYSEC-2026-2601
title: LiteLLM has a sandbox escape in custom-code guardrail
summary: LiteLLM has a sandbox escape in custom-code guardrail
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - 'litellm >= 1.81.8, < 1.83.10'
patched:
  - litellm 1.83.10
published: '2026-05-11'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:07.231161323Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wxxx-gvqv-xp7p'
references:
  - url: 'https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40217'
  - url: 'https://github.com/BerriAI/litellm'
  - url: 'https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable'
  - url: 'https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.15056
epssPercentile: 0.96576
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/learner202649/CVE-2026-40217-PoC'
  nuclei:
    - CVE-2026-40217
  checkedAt: '2026-09-24T07:53:03.093Z'
exploitAvailable: true
ingestedAt: '2026-07-13T18:58:04.786Z'
---

## Overview

### Impact

The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

**Reaching the endpoint requires a proxy-admin credential** in default configurations.

### Patches

Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.

### Workarounds

If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.

### References

- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)

## Affected packages

- `litellm >= 1.81.8, < 1.83.10`

## Remediation

Upgrade to a patched release:

- `litellm 1.83.10`