PT-2026-31920 · Litellm · Litellm

Markus Vervier · CVE-2026-40217 · Published 2026-02-19 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LiteLLM versions through 2026-04-08

Description LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test custom code URI.

Recommendations Update LiteLLM to a version later than 2026-04-08.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-420

CWE-913

Related Identifiers

BDU:2026-08668

CLEANSTART-2026-AZ09261

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-40217

ECHO-C6D4-CF5F-A050

GHSA-3926-2JVF-FG29

GHSA-WXXX-GVQV-XP7P

PYSEC-2026-2601

Affected Products

Litellm

References · 205

• 🔥 https://x41-dsec.de/lab/advisories/x41-2026-001-litellm · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NL78203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34069 · Security Note
• https://bdu.fstec.ru/vul/2026-08668 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0994 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221 · Security Note