LiteLLM Sandbox Escape via Unicode Normalization Bypass

🔍 Vulnerability Mechanism

LiteLLM custom code validation checks scripts against regex pattern blocklists (e.g., preventing access to __globals__ or __builtins__). However, the regex scan runs on the raw string before Unicode normalization (NFKC).

Python automatically normalizes full-width Unicode characters to standard ASCII at execution time.

---

💥 Exploitation Path

An attacker can write:

allow.__ｇｌｏｂａｌｓ__

The regex blacklist ignores the full-width ｇｌｏｂａｌｓ string, but Python normalizes it to standard ASCII __globals__ when executing, escaping the validation sandbox.