/Vulnerability Library

LiteLLM < 1.25.0 - Remote Code Execution

CVE-2026-40217
Verified

Description

LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/test_custom_code endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s string operations and bytecode manipulation to break out of the restricted environment. Successful exploitation may lead to remote code execution as the LiteLLM process user, which may be root when using the default Docker image.

Severity

High

CVSS Score

8.7

Exploit Probability

3%

Published Date

August 22, 2026

Template Author

ritikchaddha

CVE-2026-40217.yaml
8.7Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE ID:
cve-2026-40217
CWE ID:
cwe-94

References

https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/https://github.com/BerriAI/litellmhttps://nvd.nist.gov/vuln/detail/CVE-2026-40217

Remediation Steps

Block /guardrails/test_custom_code at the reverse proxy, restrict admin API access, avoid exposing the management interface to untrusted networks, and do not run LiteLLM as root. Apply vendor patches when available.