PyPI · litellm
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.
A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.
This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.
The issue is fixed in 1.82.0-stable.
LiteLLM recommend upgrading to 1.82.0-stable or later.
If upgrading is not immediately possible:
POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.LITELLM_MASTER_KEY is configured.Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.