# Two LiteLLM versions published containing credential harvesting malware

Advisory record · `GHSA-5mg7-485q-xm76`

- **Identifiers:** `GHSA-5mg7-485q-xm76`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **Weakness (CWE):** [CWE-506](https://cwe.mitre.org/data/definitions/506.html)
- **Tags:** [CWE-506](https://agentprime.io/advisories/tag/cwe-506.md)
- **Published:** 25 Mar 2026
- **Updated:** 27 Mar 2026
- **Reviewed by a person:** No

Published by the GitHub Advisory Database at 25 Mar 2026, 14:25 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

## Affected packages

- `litellm` (PyPI): affected `>=1.82.7, <=1.82.8`; no fixed version yet

## Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** No score.

## Timeline

This record came from the full history of the GitHub Advisory Database, published 25 Mar 2026. New records show when each source confirmed them.

## Sources

- [GitHub Advisory Database: GHSA-5mg7-485q-xm76](https://github.com/advisories/GHSA-5mg7-485q-xm76)
- [OSV: GHSA-5mg7-485q-xm76](https://osv.dev/vulnerability/GHSA-5mg7-485q-xm76)
- <https://github.com/BerriAI/litellm/issues/24518>
- <https://docs.litellm.ai/blog/security-update-march-2026>
- <https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack>
- <https://github.com/BerriAI/litellm>
- <https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml>
- <https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130>
- <https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1>
- <https://www.wiz.io/blog/teampcp-attack-kics-github-action>

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.

## Check whether this affects you

A Match means an installed version is in the affected range above. Most don’t affect the app; agentprime hasn’t analysed this one yet.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), ask your agent to check the project: `check_lockfile` sends a lockfile, `check_packages` a list of installed packages, and both return the Matches and the upgrades that clear them. `get_advisory` returns this record. Setup: <https://agentprime.io/mcp.md>
- In a browser: <https://agentprime.io/check/> reads your lockfile in the browser, never uploading it.
- Whether it touches your code, with file and line: the Claude Code plugin, <https://agentprime.io/plugin.md>
- As JSON: <https://api.agentprime.io/v1/advisories/GHSA-5mg7-485q-xm76>, or `POST https://api.agentprime.io/v1/match` with your packages (<https://agentprime.io/api.md>)

---

The web page: <https://agentprime.io/advisories/GHSA-5mg7-485q-xm76/>. Everything for agents: <https://agentprime.io/llms.txt>.