## Security Vulnerability Report

**Vulnerability:** SSRF in guardrail http_request() primitive **Severity:** Critical (CVSS 8.6) **Affected:** LiteLLM <= 1.86.2 with guardrails enabled

### Description The function in `litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py` bypasses the existing SSRF protection infrastructure (`validate_url()` / `safe_get()` in `url_utils.py`).

The function only calls `is_valid_url()` which performs syntactic URL validation via `urlparse`. It does NOT call `validate_url()` which provides: - DNS resolution with blocklist validation against private IPs - Cloud metadata IP blocking (169.254.169.254, 168.63.129.16, etc.) - TOCTOU prevention via URL-to-IP rewrite

### Recommended Fix Replace the direct HTTP client call in `http_request()` with `async_safe_get()` from `url_utils.py`, or add an explicit `validate_url()` call before making the request.

### Note I attempted to report this via Private Vulnerability Reporting API but the `/security-advisories/reports` endpoint returned HTTP 500. Please contact me if you need assistance with coordinated disclosure.

**Reported by:** Correctover Security Research