VDB

GCVE-110-OSM-2026-647

GCVE-110-OSM-2026-647
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published November 11, 2026
Contagious Interview, newly found vercel related domain that launches invisible/flexibleferret by tasks.json loading from VSCode Payload is in the github.com/BalteanuAndrei709/Multi-test-6/blob/e3a639b9d9fb0f4319f86e24d0f6eb64c1e9d2ea/.vscode/tasks.json file: https://vscode-helper171-ruby.vercel.app/settings/mac?flag=6 https://vscode-helper171-ruby.vercel.app/settings/linux?flag=6 https://vscode-helper171-ruby.vercel.app/settings/windows?flag=6
Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownall (affected)—
unknownbatch-shipyardall (affected), * (affected)—
unknownlitellm1.82.7-1.82.8 (affected)—
unknownall (affected)—

Aliases

MAL-2026-2174

References

Malicious repository: https://github.com/BalteanuAndrei709/Multi-test-6/
advisory
vendor
Malicious package:
advisory
Malicious package:
advisory
Malicious package:
advisory
Malicious pypi package: litellm
advisory
vendor
Malicious pypi package: batch-shipyard
advisory
advisory
vendor

Browse GCVE Records

851 records in the GCVE database · Updated November 12, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON
$ Lookup Community · 50/day Open Lookup ›