LiteLLM was compromised through trivy security scan in a GitHub workflow.
Attackers uploaded malicious versions of LiteLLM to PyPI. The malicious
code would exfiltrate sensitive secrets to an attcker controlled domain.
The OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.
It is considered malicious because:
• The package executes one or more commands associated with malicious behavior.
Reported by Google Open Source Security and ossf-package-analysis via OSV.
// versions and what to do
Malicious
1.82.8, 1.82.7, 1.107.0
Move to
1.108.1 newest 1.x release, no known advisory
1.108.2 is newer but was published less than 6 hours ago. The CyberXYZ Proxy holds a new release for 6 hours before it installs without an alert, so it is not named here yet.
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Checked 2026-11-06 at 22:38 UTC. The most recent advisory here was published 2026-10-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.