The LiteLLM proxy's /guardrails/test_custom_code endpoint allows authenticated users to submit arbitrary Python code for guardrail testing. Regex-based source code filtering is bypassed via string concatenation and CPython bytecode manipulation, enabling arbitrary code execution on the server.
| Vendor | Product | Versions |
|---|---|---|
| berriai | litellm | main-latest (docker image ghcr.io/berriai/litellm:main-latest, repo digest ghcr.io/berriai/litellm@sha256:bb0639701796218a3447160e55c0f1097446e4e6085df7dfd39f476d4143743f) |
