Variant analysis following GHSA-wxxx-gvqv-xp7p (custom-code sandbox escape, fixed in 1.83.11) and GHSA-xqmj-j6mv-4862 (SSTI in `/prompts/test`, fixed in 1.83.7). Public source code review at HEAD; no proof-of-concept, no testing against any deployed instance.

Filing as a regular issue rather than a security advisory because both findings below are admin-gated (so they're DoS-by-admin, not external attacker reachable) and the third item is a design note rather than a bug. If you'd prefer any of them be tracked privately, let me know and I'll re-route.

---

## Finding 1 — Module-level `exec()` in `POST /guardrails/test_custom_code` runs without timeout protection (Low-Medium, DoS-by-admin)

**File:** `litellm/proxy/guardrails/guardrail_endpoints.py`, around line 2097

The endpoint correctly requires `PROXY_ADMIN` (line 2084) and correctly applies a 5-second `concurrent.futures.ThreadPoolExecutor` timeout to the `apply_guardrail` *function call* (lines 2149-2158). However, the **module-level `exec()` at line 2097 runs in the FastAPI handler thread with no timeout**:

```python EXECUTION_TIMEOUT_SECONDS = 5

try: exec_globals = build_sandbox_globals()

try: compiled =…