AdvisoriesToolsStatsChecklistSubmitGet the email
← All issues
The weekly email · 2026-10-29

A poisoned LiteLLM release, Supabase's October 30 change, and three Cursor fixes

41 new entries this week, from a credential-stealing LiteLLM build to MCP servers that let anyone in. Here's what to check.

We added 41 new entries to VibeVulns this week, which brings the total to 183. Two of them need attention right away, so those come first.

LiteLLM 1.107.0 was malware

Critical. On October 21 a malicious litellm 1.107.0 was published to PyPI and pushed to LiteLLM's official Docker images. It adds Python startup hooks that steal credentials and set up an hourly remote-code loader, and it runs as soon as Python starts, even if you never import litellm. If you installed or pulled that version, treat the machine as compromised.

How to check and fix it

Supabase changes table access tomorrow, October 30

Heads-up. From October 30, Supabase stops granting anon, authenticated and service_role access to new tables in the public schema of existing projects. A new table won't be reachable through supabase-js, REST or GraphQL until you GRANT access explicitly, and RLS still has to be on as well. If your app creates tables and suddenly gets empty results, this is why.

What changes and what to do

MLflow 3.17.0 fixes unauthenticated code execution

Critical. Three MLflow advisories came out on October 27, all fixed in 3.17.0. The worst lets anyone who can reach a default no-auth MLflow server upload a Python file and get the server to run it through the third-party scorer endpoint. The others allow reading any file the server can read, and make mlflow.crewai.autolog() write CrewAI API keys into traces. A separate scorer-endpoint SSRF also went in this week.

How to check and fix it · The SSRF

Three Cursor bugs, all fixed in current versions

These were disclosed earlier in the year and are fixed in recent Cursor releases, but they're worth knowing about if you or your team run an old build:

More fake AI packages

Critical. A PyPI package called aanthropic, one letter off from Anthropic's official anthropic package, runs malware when you install it. On npm, GitHub flagged agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude as malware. If any of these was installed, treat that computer as compromised.

The PyPI package · The npm packages

A login page that shipped its data anyway

Bootlegger, a South African coffee chain, had an internal dashboard (reportedly built with Claude and hosted on Railway) that showed a login screen but already included its data in the page. Anyone with the URL could read contact details for 132 locations and some financial data from the page source. It's a good reminder to check what your login page actually sends before anyone signs in.

What happened

Storybook dev server

Critical. While a vulnerable Storybook dev server is running and open in your browser, a malicious website can, with some user interaction, change story files in your project. Patched in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6, and @storybook/addon-mcp 10.6.2.

How to check and fix it

MCP servers and SDKs

Lots of MCP fixes this week. The first five are rated critical:

LiteLLM, Langflow and other AI infrastructure

PraisonAI, again

Eight PraisonAI entries this week, five of them critical. If you use it, upgrade the praisonai npm package to 1.7.2, praisonaiagents to 1.6.59 or later, praisonai to 4.6.59 and praisonai-platform to 0.1.6:

Some of these were disclosed earlier in the year and only made it into VibeVulns this week, so the fixes may already be out. Each page has the check and the fix.

Found something we missed? Send it in. Every entry needs a public source.