criticalVulnerability
GHSA-5mg7-485q-xm76
After an API Token exposure from an exploited trivy dependency, two new releases of `litellm` were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate thema ccordingly.
Properties
- ghsa_id
- GHSA-5mg7-485q-xm76
- severity
- critical
- summary
- Two LiteLLM versions published containing credential harvesting malware
- cve_id
- GHSA-5mg7-485q-xm76
- is_ghsa_only
- true
- ghsa_published
- 2026-03-25T14:25:42Z
- source_url
- https://github.com/advisories/GHSA-5mg7-485q-xm76
- ghsa_updated
- 2026-03-27T00:32:12Z
Related Entities (3)
AFFECTS (1)
→[Software]pip/litellm
HAS_WEAKNESS (1)
→[Weakness]Embedded Malicious Code
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph