From 58b5df4aa051858e635573acca7f224dde06eb2e Mon Sep 17 00:00:00 2001 From: Aishwary Dongre Date: Thu, 15 Oct 2026 17:05:41 +0530 Subject: [PATCH] fix: always prioritize messages for prompt redaction to prevent bypass - Remove conditional check that could discard message-based redactions - Always use messages as source of truth after guardrail processing - Fixes MEDIUM severity: prompt precedence bypass when multiple guardrails apply different masks --- litellm/proxy/image_endpoints/endpoints.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/litellm/proxy/image_endpoints/endpoints.py b/litellm/proxy/image_endpoints/endpoints.py index e236d24c77f..a4853fe5bda 100644 --- a/litellm/proxy/image_endpoints/endpoints.py +++ b/litellm/proxy/image_endpoints/endpoints.py @@ -145,12 +145,11 @@ async def image_generation( user_api_key_dict=user_api_key_dict, data=data, call_type="image_generation" ) - # Guardrails may redact data["prompt"] directly. Only rebuild from messages if prompt wasn't modified. - prompt_after_hook: Final = data.get("prompt") - if prompt_after_hook == prompt_value: - messages: Final = data.get("messages") - if isinstance(messages, list) and messages: - data["prompt"] = get_str_from_messages(messages) + # Guardrails may redact messages. Always use messages as source of truth if they exist. + # If both prompt and messages were modified, prefer messages since that's what guardrails processed. + messages: Final = data.get("messages") + if isinstance(messages, list) and messages: + data["prompt"] = get_str_from_messages(messages) data.pop("messages", None) ## ROUTE TO CORRECT ENDPOINT ##