GitHub Remote Code Execution Vulnerability
Evidence indicates that GitHub is affected by remote code execution. Reported affected versions include < 1.83.11.
RESOLVED
What Happened
Evidence indicates that GitHub is affected by remote code execution. Reported affected versions include < 1.83.11.
Why This Matters
The evidence matters to defenders using GitHub because it could let an attacker run code in affected environments.
Recommended Action
block POST /guardrails/test_custom_code at your reverse proxy or API gateway. Identify deployments of GitHub matching the evidenced affected versions: < 1.83.11.
Exposure
Exposure unknown
May 11, 2026 21:47
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: THEORETICAL
Affected versions: < 1.83.11
Primary entities:
Timeline
-
Incident first seen
May 11, 2026 21:47BugSkan first recorded this incident.
-
LiteLLM has a sandbox escape in custom-code guardrail
May 11, 2026 21:47GitHub Advisory Database · Vulnerability
Sources
GitHub Advisory Database · May 11, 2026 21:47
### Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. **Reaching the endpoint requires a proxy-admin credential** in default configurations. ### Patches Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. ### Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. ### References - Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)
Open publisher sourceMy Interests Match
Create an account to see which incidents overlap with your interests.