LiteLLM versions from 1.81.8 up to but not including 1.83.10 contain a sandbox escape vulnerability in the custom-code guardrail feature. This flaw allows users with proxy-admin credentials to execute arbitrary code as root via the POST /guardrails/test_custom_code endpoint. The issue arises from a hand-rolled Python sandbox that can be bypassed using bytecode-level techniques. The vulnerability is fixed in version 1.83.10 by replacing the sandbox with RestrictedPython. Until patched, blocking access to the vulnerable endpoint is recommended.