CVE-2026-40217

描述

### Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. **Reaching the endpoint requires a proxy-admin credential** in default configurations. ### Patches Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. ### Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. ### References - Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)

如何修補 CVE-2026-40217

要修補 CVE-2026-40217,請將受影響套件升級到下列已修補版本。

• —升級至 1.83.10 或更新版本
• —升級至 1.83.10 或更新版本

CVE-2026-40217 正在被利用嗎?

中等 — EPSS 為 6.5%,可持續追蹤但非最高優先。

受影響套件(2)

• >= 1.81.8, < 1.83.10
• >= 1.81.8, < 1.83.10

CVSS 分數

參考連結(7)

• ADVISORYgithub.com/advisories/GHSA-wxxx-gvqv-xp7p
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-40217
• PATCHgithub.com/BerriAI/litellm
• PATCHpypi.org/project/litellm
• WEBgithub.com/BerriAI/litellm/releases/tag/v1.83.10-stable