pip-audit
A dependency vulnerability auditing tool in the Python ecosystem, used to scan packages installed in a project for known security vulnerabilities.
Timeline (last 90 days)
Running npm audit or pip-audit regularly can expose known vulnerabilities, but it cannot replace human judgment about whether this package is really needed.
The LiteLLM vulnerability GHSA-g5ff-637f-6q2m (high severity) affects versions before 1.95.0, where a user with the read-only role internal_user_viewer can read local files on the proxy host via vertex_ai_credentials, and at the time the advisory was published it had not yet entered the GitHub Advisory Database or OSV.dev, so pip-audit could not scan for it.
All Facts (2)
Running npm audit or pip-audit regularly can expose known vulnerabilities, but it cannot replace human judgment about whether this package is really needed.
50%UnverifiedThe LiteLLM vulnerability GHSA-g5ff-637f-6q2m (high severity) affects versions before 1.95.0, where a user with the read-only role internal_user_viewer can read local files on the proxy host via vertex_ai_credentials, and at the time the advisory was published it had not yet entered the GitHub Advisory Database or OSV.dev, so pip-audit could not scan for it.
50%