LiteLLM is an AI gateway that proxies Custom Code Guardrails feature in production does not enforce the sandboxing applied to the test endpoint. This allows a user with permission to create or update guardrails to submit arbitrary Python code that runs in the LiteLLM process. The vulnerability is a code injection flaw (CWE‑94). With execution, an attacker can read or exfiltrate secrets, environment variables, or other data available to the host process. Though the CVSS score is 2.1, indicating limited technical scope, the impact is high for anyone who can gain privileged guardrail configuration access.

BerriAI's LiteLLM installations running any version prior to 1.82.0-stable, where the custom code guardrails production create and update paths did not enforce sandboxing and validation, are affected. Versions 1.82.0-stable and later have fixed the issue.

The EPSS score of < 1 % indicates a very low probability of exploitation in the wild. The CVSS score of 2.1 indicates limited technical scope and a low impact for systems that are not privileged. The vulnerability is not listed in CISA KEV. Attackers must first acquire privileged access to the guardrail configuration—typically through an insider or compromised administrative credential—before injecting and executing malicious code. Without such privilege, the flaw cannot be triggered remotely from the external network.