Last seen May 11, 2026

GitHub Remote Code Execution Vulnerability

Evidence indicates that GitHub is affected by remote code execution. Reported affected versions include < 1.83.11.

Technical Severity
Medium severity
Lifecycle Status

RESOLVED

Sources

What Happened

Evidence indicates that GitHub is affected by remote code execution. Reported affected versions include < 1.83.11.

Why This Matters

The evidence matters to defenders using GitHub because it could let an attacker run code in affected environments.

Recommended Action

block POST /guardrails/test_custom_code at your reverse proxy or API gateway. Identify deployments of GitHub matching the evidenced affected versions: < 1.83.11.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

May 11, 2026 21:47

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: THEORETICAL

Affected versions: < 1.83.11

Primary entities:

BerriAIGitHublitellmRemote Code ExecutionvulnerabilityBerriAI/litellm

Timeline

  • Incident first seen
    May 11, 2026 21:47

    BugSkan first recorded this incident.

  • LiteLLM has a sandbox escape in custom-code guardrail
    May 11, 2026 21:47

    GitHub Advisory Database · Vulnerability

Sources

LiteLLM has a sandbox escape in custom-code guardrail

GitHub Advisory Database · May 11, 2026 21:47

### Impact The `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image. **Reaching the endpoint requires a proxy-admin credential** in default configurations. ### Patches Fixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later. ### Workarounds If upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway. ### References - Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence