{"record":{"id":"393226b8431499bf","repo":"BerriAI/litellm","slug":"content-blocked-executable-code-block-detected-l","errorCode":null,"errorMessage":"Content blocked: executable code block detected (language: {language})","messagePattern":"Content blocked: executable code block detected \\(language: (.+?)\\)","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/block_code_execution/block_code_execution.py","lineNumber":495,"sourceCode":"                should_raise = True\n            parts.append(text[last_end:start])\n            if effective_block:\n                parts.append(self.MASK_PLACEHOLDER)\n            else:\n                parts.append(text[start:end])\n            last_end = end\n\n        parts.append(text[last_end:])\n        new_text: Final = \"\".join(parts)\n        return new_text, should_raise\n\n    def _raise_block_error(self, language: str, is_output: bool, request_data: dict) -> None:\n        if language == \"execution_request\":\n            msg = \"Content blocked: execution request detected\"\n        else:\n            msg = f\"Content blocked: executable code block detected (language: {language})\"\n        if is_output:\n            raise HTTPException(\n                status_code=400,\n                detail={\n                    \"error\": msg,\n                    \"guardrail\": self.guardrail_name,\n                    \"language\": language,\n                },\n            )\n        self.raise_passthrough_exception(\n            violation_message=msg,\n            request_data=request_data,\n            detection_info={\"language\": language},\n        )\n\n    @log_guardrail_information\n    async def apply_guardrail(\n        self,\n        inputs: GenericGuardrailAPIInputs,\n        request_data: dict,","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/block_code_execution/block_code_execution.py#L477-L513","documentation":"The Block Code Execution guardrail found a fenced code block whose language tag matches blocked_languages (or default executable languages) at/above confidence_threshold with action=block, and rejected the content. The language tag from the fence (e.g., python, bash) is embedded in the message. Input-side blocks surface as ModifyResponseException (HTTP 200 with the block message, LLM never invoked); output-side blocks raise HTTPException 400 with detail {error, guardrail, language}.","triggerScenarios":"A prompt or model response contains a fenced block like ```python ... ``` where the language matches the configured blocked_languages and the classifier confidence meets confidence_threshold; for requests, execution intent must also be present when detect_execution_intent is on. Masked fences are replaced with a placeholder when effective_block is false.","commonSituations":"Coding assistants blocked from returning runnable Python/Bash snippets by a compliance guardrail; broad default language lists catching innocuous languages (sql, javascript); users wrapping prose in triple backticks getting flagged because a language tag matched; response-side enforcement surprising teams that only expected request scanning.","solutions":["Remove the offending language from blocked_languages (or set blocked_languages: null and rely on intent only) so legitimate snippets pass.","Use action: mask to replace the block with a mask placeholder instead of failing the call.","Lower/raise confidence_threshold so only high-confidence executable blocks are caught.","Client-side: catch the 400 detail.language / 200 violation message and ask the user to rephrase without the fenced block."],"exampleFix":"# before — every python fence is rejected\nlitellm_params:\n  guardrail: block_code_execution\n  blocked_languages: [python, bash, javascript, sql]\n  action: block\n\n# after — mask python, block only shell code\nlitellm_params:\n  guardrail: block_code_execution\n  blocked_languages: [bash, sh]\n  mask_languages: [python]\n  action: block","handlingStrategy":"try-catch","validationCode":"# Client-side pre-scan approximating the guardrail's fence detection\nimport re\nFENCE = re.compile(r\"```([a-zA-Z0-9_+-]*)\")\nBLOCKED = {\"python\", \"py\", \"bash\", \"sh\", \"javascript\", \"js\"}\ndef violates_code_block_policy(text: str) -> str | None:\n    for m in FENCE.finditer(text):\n        lang = m.group(1).lower()\n        if lang in BLOCKED:\n            return lang\n    return None\nlang = violates_code_block_policy(prompt)  # strip the fence or rephrase before sending","typeGuard":null,"tryCatchPattern":"try:\n    resp = litellm.completion(..., guardrails=[\"block-code-exec\"])\nexcept Exception as e:\n    detail = getattr(e, \"detail\", None) or {}\n    lang = detail.get(\"language\") if isinstance(detail, dict) else None\n    if lang or \"executable code block detected\" in str(e):\n        return handle_policy_block(lang)  # user-facing message, no retry\n    raise\n# input-side: a 200 whose body is the violation message — detect and surface it","preventionTips":["Keep blocked_languages minimal — only languages your policy actually prohibits.","Use action: mask first so violations redact instead of fail.","Remember responses are always enforced regardless of intent — test both directions.","Set confidence_threshold high enough that ordinary prose in backticks is not flagged."],"tags":["litellm","guardrails","block-code-execution","content-moderation","code-fence"],"backgroundTag":"guardrail-content-blocked","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}