VDB
GCVE-110-OSM-2026-9596
GCVE-110-OSM-2026-9596
Advisory PublishedCVSS 5.4/10
This is a brand-new single-version PyPI package from a first-time publisher with no repository, claiming to be an 'Instagram CLI' — a category frequently used as cover for credential stealers. This package gathers system and user information and exfils to a Discord endpoint controlled by the threat actor.
EXFIL
- System Information Collection in instalogin/dashboard.py: "platform.system()"
- Network Request in instalogin/shell.py: "requests.post("
ADDITIONAL FINDINGS
- Shell Command Execution in instalogin/banner.py: "os.system("
PAYLOAD FILES
instalogin/dashboard.py (+ instalogin/shell.py)
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | instalogin1234 | all (affected) | — |
Aliases
Browse GCVE Records
67,860 records in the GCVE database · Updated August 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.