LiteLLM implementations prior to April 8 2026 contain a flaw that allows attackers to inject and execute arbitrary bytecode through the /guardrails/test_custom_code endpoint. The vulnerability stems from unsafe bytecode rewriting, a form of code injection (CWE-94) coupled with improper access controls that bypass authentication (CWE-420), enabling the execution of arbitrary code on the host system. The impact is a full compromise of confidentiality, integrity and availability on the compromised machine.

The issue affects BerriAI’s LiteLLM product. All versions of LiteLLM released on or before April 8 2026 are impacted. Precise version numbers are not listed, so any installation derived from the affected code base should be assumed vulnerable.

The CVSS score of 8.8 indicates high severity, while an EPSS score of 6% indicates a moderate likelihood of exploitation. The vulnerability is not currently flagged in the CISA KEV catalog. Based on the description, it is inferred that a remote HTTP request to the /guardrails/test_custom_code URI could be used as the attack vector, requiring network reachability to the service. If the endpoint is publicly reachable, an attacker can exploit this flaw without user interaction. The absence of additional mitigations in the cited advisory indicates the flaw can be fully leveraged once the endpoint is reachable.