Описание
LiteLLM has a sandbox escape in custom-code guardrail
Impact
The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.
Reaching the endpoint requires a proxy-admin credential in default configurations.
Patches
Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.
Workarounds
If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.
References
- Patched release:
v1.83.10-stable
Пакеты
litellm
>= 1.81.8, < 1.83.10
1.83.10
Связанные уязвимости
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
Уязвимость прокси-сервера LiteLLM, связанная с использованием незащищенного альтернативного канала, позволяющая нарушителю выполнить произвольный код