CVE-2026-40217

Affected versions of the litellm package are vulnerable to Sandbox Escape due to an insufficient hand-rolled sandbox in the custom-code guardrail testing endpoint. The POST /guardrails/test_custom_code endpoint executes user-supplied Python code within a custom sandbox that can be bypassed using bytecode-level techniques, allowing arbitrary code execution in the proxy process. An attacker with proxy-admin credentials can escape the sandbox to achieve arbitrary code execution, which runs as root in the default Docker image.