LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217) - ATR-2026-01935 (e41645e9-6f53-5e5c-9010-7595d5236ca6)
Detects CVE-2026-40217 (CWE-94/CWE-265): LiteLLM's custom-code guardrail test/compile path /guardrails/test_custom_code evaluates caller-supplied Python in an unsafe sandbox that can be escaped via bytecode rewriting and dunder-attribute traversal, yielding server-side code execution as the LiteLLM proxy process. Affected through 2026-04-08 builds. Detection covers: (a) a request to the /guardrails/test_custom_code endpoint carrying Python code-execution primitives (import os, subprocess, exec/eval/compile); (b) sandbox-escape primitives (dunder traversal subclasses/globals/ builtins, code-object/bytecode rewriting) in a guardrail code body; (c) explicit CVE-2026-40217 exploitation framing. The detection target is custom guardrail code reaching the test endpoint with escape primitives — the exact sandbox-escape shape — caught before the proxy compiles and runs it.