EUVD-2026-42350
GHSA-72m8-9m7m-h278
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects mandatory guardrail admin privilege; AV:N for API exposure; limited C/I/A impact confined to proxy process secrets.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 5 pypi packages depend on litellm (4 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.82.0.
DescriptionCVE.org
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
AnalysisAI
Custom Code Guardrails in LiteLLM's AI Gateway proxy prior to 1.82.0-stable permitted privileged users with guardrail management rights to submit arbitrary Python code via the production create and update API paths, which executed unsandboxed within the proxy process. Unlike the test endpoint - which enforced sandbox controls - the production paths lacked equivalent validation, enabling the injected code to access and expose secrets, API keys, and environment variables available to the running process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; risk is highest in multi-tenant or multi-operator LiteLLM deployments where guardrail management rights are distributed.
Technical ContextAI
LiteLLM (CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source AI Gateway that proxies requests to various LLM provider APIs in a unified OpenAI-compatible format. Its Custom Code Guardrails feature allows operators to define Python logic that runs inline within the proxy to inspect or filter LLM inputs and outputs. The root cause is CWE-94 (Improper Control of Generation of Code - Code Injection): the production guardrail create and update API paths accepted Python code and executed it without applying the same sandboxing and validation enforced by the test endpoint, creating an asymmetric security posture. Since the LiteLLM proxy typically holds LLM provider API keys and other credentials as process environment variables, unsandboxed code execution in this context directly threatens secret confidentiality. The CVSS 4.0 vector includes AT:P, reflecting that a specific precondition - possession of guardrail management privileges - must be met before exploitation is possible.
RemediationAI
The primary fix is to upgrade LiteLLM to version 1.82.0-stable or later, which applies consistent sandboxing and validation to both the test and production guardrail API paths; the release is available at https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable and the remediation commit can be reviewed at https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba. Prior to patching, organizations should restrict access to the guardrail create and update API paths exclusively to fully trusted, owner-level administrators - removing this right from any delegated or shared privileged accounts eliminates the attack surface entirely since the vulnerability requires PR:H. Additionally, audit all existing custom guardrail code for malicious or unexpected logic, and proactively rotate LLM provider API keys and any other secrets stored in the proxy environment if suspicious guardrail activity is suspected. Note that restricting guardrail management access may impact workflows that rely on delegated guardrail administration.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today