pip-audit
A dependency vulnerability auditing tool in the Python ecosystem, used to scan packages installed in a project for known security vulnerabilities.
Timeline (last 90 days)
Tools such as pip list, pipdeptree or pip-audit can be used to output the full dependency graph and, combined with vulnerability databases such as OSV and GitHub Advisory, compare version ranges to confirm whether a vulnerable version has been introduced.
Running npm audit or pip-audit regularly can expose known vulnerabilities, but it cannot replace human judgment about whether this package is really needed.
The LiteLLM vulnerability GHSA-g5ff-637f-6q2m (high severity) affects versions before 1.95.0, where a user with the read-only role internal_user_viewer can read local files on the proxy host via vertex_ai_credentials, and at the time the advisory was published it had not yet entered the GitHub Advisory Database or OSV.dev, so pip-audit could not scan for it.
All Facts (3)
Tools such as pip list, pipdeptree or pip-audit can be used to output the full dependency graph and, combined with vulnerability databases such as OSV and GitHub Advisory, compare version ranges to confirm whether a vulnerable version has been introduced.
50%UnverifiedRunning npm audit or pip-audit regularly can expose known vulnerabilities, but it cannot replace human judgment about whether this package is really needed.
50%UnverifiedThe LiteLLM vulnerability GHSA-g5ff-637f-6q2m (high severity) affects versions before 1.95.0, where a user with the read-only role internal_user_viewer can read local files on the proxy host via vertex_ai_credentials, and at the time the advisory was published it had not yet entered the GitHub Advisory Database or OSV.dev, so pip-audit could not scan for it.
50%