CVE-2026-59821 — Code Injection in Berriai Litellm

Vendor	Product	Version range	Fixed in
berriai	litellm	< 1.82.0-stable	1.82.0-stable
litellm	litellm	< 1.82.0	1.82.0
litellm	litellm	—	—
litellm	litellm	>= 0 < 1.82.0	1.82.0

VulDB

BerriAI litellm up to 1.65.4 Custom Code Guardrails sandbox (EUVD-2026-42350 / WID-SEC-2026-2263)

vuldb·2026-07-23·CVSS 7.2

CVE-2026-59821 [HIGH] BerriAI litellm up to 1.65.4 Custom Code Guardrails sandbox (EUVD-2026-42350 / WID-SEC-2026-2263) A vulnerability was found in BerriAI litellm up to 1.65.4 and classified as problematic. This impacts an unknown function of the component Custom Code Guardrails. The manipulation results in sandbox issue. This vulnerability was named CVE-2026-59821. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

GHSA

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

ghsa·2026-07-22

CVE-2026-59821 [LOW] CWE-94 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks ### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upg

VulnCheck

litellm litellm Improper Authentication

vulncheck·2026·CVSS 8.2

CVE-2026-59822 [HIGH] litellm litellm Improper Authentication litellm litellm Improper Authentication LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0. Affected: litellm litellm Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Exploitation References: https://www.linkedin.com/posts/yaarashriki_cve-2026-59821-cve-2026-59822-i-found-activity-748

VulnCheck

litellm litellm Improper Control of Generation of Code ('Code Injection')

vulncheck·2026·CVSS 7.2

CVE-2026-59821 [HIGH] litellm litellm Improper Control of Generation of Code ('Code Injection') litellm litellm Improper Control of Generation of Code ('Code Injection') LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable. Affected: litellm litellm Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Exploitation References: https://www.linked

Red Hat

litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails

vendor_redhat·2026-07-08·CVSS 2.1

CVE-2026-59821 [LOW] CWE-94 litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable. A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. A privileged user with access to create or update custom code guardrails could exploit this vulnerability. The flaw allowed

CVE-2026-59821: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production…

Affected

CVSS provenance