CVE-2026-40217
Arbitrary code execution via bytecode rewriting in LiteLLM guardrails endpoint
LiteLLM through 2026-04-08 lets a remote attacker rewrite bytecode through the /guardrails/test_custom_code URI and execute arbitrary code. This high-severity flaw affects BerriAI LiteLLM. CISA assesses exploit code as proof-of-concept, but the issue is not on its known-exploited list, so there is no known use by attackers, and no fixed version is given.
BerriAI LiteLLM · Updated 3 Nov · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeverityhighCVSS 8.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| litellm (pip) 1.83 | 1.83.10 |
What to do
- No fixed version is listed in the available records. No workaround is provided in the available records, so monitor BerriAI LiteLLM updates for guidance.
What happened
- 8 AprAffected LiteLLM versions are documented as those through this date.
- 3 NovBleepingComputer reports Google saying LLMjacking attacks rack up $1 million in cloud AI charges.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-40217 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. | high 8.8 | No | 16% |
Our reporting
3 NovLLMjacking attacks can run up $1 million in cloud AI charges, Google researchers reportReported elsewhere
BleepingComputer · 3 NovGoogle: LLMjacking attacks rack up $1 million in cloud AI charges ↗The records
CVE-2026-40217 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free