LiteLLM implementations prior to April 8 2026 contain a flaw that allows attackers to inject and execute arbitrary bytecode through the /guardrails/test_custom_code endpoint. The vulnerability stems from unsafe bytecode rewriting, which can lead to execution of arbitrary code on the host system. This flaw can compromise confidentiality, integrity, and availability of the affected environment, potentially allowing a remote attacker to gain full control of the affected service.

The issue affects BerriAI’s LiteLLM product. All versions of LiteLLM released on or before April 8 2026 are impacted. Precise version numbers are not listed, so any installation derived from the affected code base should be assumed vulnerable.

The CVSS score of 8.8 indicates high severity, while an EPSS score below 1 % suggests limited current exploitation activity. The vulnerability is not currently flagged in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request to the /guardrails/test_custom_code URI, requiring network reachability to the service. If the endpoint is publicly reachable, an attacker can exploit this flaw without user interaction. The absence of additional mitigations in the cited advisory indicates the flaw can be fully leveraged once the endpoint is reachable.