Cloudanix VulnDB

GHSA-5mg7-485q-xm76

None

Two LiteLLM versions published containing credential harvesting malware

CVSS

—

EPSS

—

Published

Mar 25, 2026

CISA due date

—

The record

After an API Token exposure from an exploited trivy dependency, two new releases of `litellm` were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Anyone who has installed and run the project should assume any credentials available to litellm environment may have been exposed, and revoke/rotate thema ccordingly.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities