{"id":"CVE-2026-40217","published":"2026-04-10T13:43:23Z","modified":"2026-07-15T01:01:14Z","title":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the…","vendor":"BerriAI","product":"LiteLLM","tier":"core","eol":null,"affectedVersions":[{"vendor":"BerriAI","product":"LiteLLM","versions":["bb0639701796218a3447160e55c0f1097446e4e6085df7dfd39f476d4143743f"]}],"description":{"text":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in BerriAI's LiteLLM, in its guardrails handling at the /guardrails/test_custom_code endpoint, which permits code injection through bytecode rewriting. An attacker with remote network access and low-privilege authentication, requiring no user interaction, can execute arbitrary code on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:27Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.15532,"percentile":0.96825,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-30","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":14,"pulses":[{"name":"LiteLLM sk-1234 Exposure + Exploited MCP/RCE CVEs (KEV)","url":"https://otx.alienvault.com/pulse/6aa39a4af4f2339cd861d731","created":"2026-09-11"},{"name":"Known_Cve | Apr 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69ea3f5ba5d3a028c6ef7ecf","created":"2026-04-23"},{"name":"Known_Cve | Apr 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e8ec53d8e9285aa573199c","created":"2026-04-22"},{"name":"Known_Cve | Apr 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e79c01c3d8244296d32902","created":"2026-04-21"},{"name":"Known_Cve | Apr 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e64ae4502f00a0cc9986e5","created":"2026-04-20"},{"name":"Known_Cve | Apr 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e4f971582b6761602eb4a2","created":"2026-04-19"},{"name":"Known_Cve | Apr 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e3a7638300f0eb1346a035","created":"2026-04-18"},{"name":"Known_Cve | Apr 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e25442402a04b23b8aa1a2","created":"2026-04-17"},{"name":"Known_Cve | Apr 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e103976603776b725a4a5a","created":"2026-04-16"},{"name":"Known_Cve | Apr 15, 2026","url":"https://otx.alienvault.com/pulse/69de5f919b88b9566b77d9fa","created":"2026-04-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-420","name":"Unprotected Alternate Channel"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40217","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457301","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40217.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30056","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.81.8, <1.83.10"],"patched":["1.83.10"],"from":["GHSA-wxxx-gvqv-xp7p","PYSEC-2026-2601"],"provenance":"source"}],"advisories":[{"id":"GHSA-wxxx-gvqv-xp7p","url":"https://github.com/advisories/GHSA-wxxx-gvqv-xp7p","severity":"HIGH","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.81.8, <1.83.10"],"patched":["1.83.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-21376","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21376","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-05-19","earliestUrl":"https://github.com/learner202649/CVE-2026-40217-PoC","repos":[{"name":"learner202649/CVE-2026-40217-PoC","url":"https://github.com/learner202649/CVE-2026-40217-PoC","stars":0,"created":"2026-05-19"}]},"nuclei":[{"id":"CVE-2026-40217","name":"LiteLLM < 1.25.0 - Remote Code Execution","severity":"high","path":"http/cves/2026/CVE-2026-40217.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40217.yaml"}],"first":{"date":"2026-05-19","source":"PoC-in-GitHub","url":"https://github.com/learner202649/CVE-2026-40217-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-40217","provenance":"source"},{"date":"2026-05-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/learner202649/CVE-2026-40217-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":39,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 93 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.37,"detail":"percentile 0.9683"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.67,"detail":"14 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}