Last seen July 23, 2026

Custom Code Guardrails Remote Code Execution Vulnerability

Evidence indicates that Custom Code Guardrails is affected by remote code execution.

Technical Severity
Medium severity
Lifecycle Status

RESOLVED

Sources

What Happened

Evidence indicates that Custom Code Guardrails is affected by remote code execution.

Why This Matters

The evidence matters to defenders using Custom Code Guardrails because it could let an attacker run code in affected environments.

Recommended Action

Avoid enabling Custom Code Guardrails for untrusted users Confirm whether Custom Code Guardrails is present in your environment and review the affected configuration.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Jul 23, 2026 04:08

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

LiteLLMCustom Code GuardrailsRemote Code ExecutionvulnerabilityBerriAI/litellm

Timeline

  • Incident first seen
    Jul 23, 2026 04:08

    BugSkan first recorded this incident.

  • LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
    Jul 23, 2026 04:08

    GitHub Advisory Database · Vulnerability

  • LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
    Jul 23, 2026 04:08

    OSV.dev · Vulnerability

Sources

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

GitHub Advisory Database · Jul 23, 2026 04:08

### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only. 2. Ensure `LITELLM_MASTER_KEY` is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.

Open publisher source
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

OSV.dev · Jul 23, 2026 04:08

### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only. 2. Ensure `LITELLM_MASTER_KEY` is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.

Open publisher source

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence