CriticalVulnerabilityLLM-specific
GHSA-5mg7-485q-xm76: Two LiteLLM versions published containing credential harvesting malware
- Identifier
- GHSA-5mg7-485q-xm76
- Published
- Record updated
- Affected
- litellm >= 1.82.7, <= 1.82.8
- Fixed in
- No fixed version was stated when the source was last read.
Summary
GitHub's Advisory Database published GHSA-5mg7-485q-xm76 on March 25, 2026, covering two malicious releases of the pip package litellm. Versions >= 1.82.7 and <= 1.82.8 were published containing credential harvesting malware, and the advisory lists no patched versions.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents
Related items
- MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
- MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
- InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
- InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
- MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog