{"answers":{"affected":"2 open source packages ship an affected version, including semantic-router.","exploited":"There is no known exploitation of GHSA-98x5-vq43-vc5p in the wild and no public exploit code.","fix":"Upgrade semantic-router to 0.1.15 or later.","what":"GHSA-98x5-vq43-vc5p is a vulnerability in semantic-router, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-98x5-vq43-vc5p and fix it if it is affected.\n\nWhat it is: GHSA-98x5-vq43-vc5p is a vulnerability in semantic-router, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-98x5-vq43-vc5p in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- semantic-router (PyPI): affected from 0.1.8; fixed in 0.1.15\n- semantic-router (PyPI): affected from 0.1.8; fixed in 0.1.15\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/ (Markdown: https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/index.md)","id":"GHSA-98x5-vq43-vc5p","markdown":"https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/index.md","name":"GHSA-98x5-vq43-vc5p","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Python routing library","requires_auth":"none","summary":"Attackers can steal credentials and execute code via a compromised dependency wheel installed by semantic-router users during a specific time window.","user_interaction":"required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Impact\nsemantic-router versions 0.1.8 through 0.1.14 declare `litellm\u003e=1.61.3` with no upper bound. During the window in which `litellm==1.82.8` was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel.\n\nThe malicious `litellm==1.82.8` wheel ships a `litellm_init.pth` file that executes on Python interpreter startup — no import required. It collects and exfiltrates:\n- Process environment variables\n- AWS / GCP / Azure credentials\n- SSH keys, Kubernetes configs, shell history\n- Database credentials and CI/CD secrets\n- Cryptocurrency wallets\n\nStage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to `https://models.litellm.cloud/`.\n\nSee upstream: [BerriAI/litellm#24512](https://github.com/BerriAI/litellm/issues/24512) and [CVE-2026-42208](https://www.cve.org/CVERecord?id=CVE-2026-42208).\n\n## Patches\nFixed in **semantic-router 0.1.15**, which raises the floor to `litellm\u003e=1.83.7`.\n\n## Workarounds\nIf developers cannot upgrade immediately:\n- Pin `litellm\u003e=1.83.7,!=1.82.8` explicitly in their own project.\n- Audit `site-packages/` for `litellm_init.pth` and delete if present.\n- Rotate any credentials reachable from environments where an affected install ran.\n\n## Credit\nUpstream report and triage by the litellm maintainers — see issue [#24512](https://github.com/BerriAI/litellm/issues/24512).\n\nOne caveat before publishing\n\nCVE-2026-42208 specifically names 1.82.8. Pip's resolver picks \"latest matching\", so the real affected blast radius for semantic-router is users who ran pip install during the window that 1.82.8 was on PyPI — not everyone who ever installed 0.1.8–0.1.14. The advisory is still correct (an affected install could have pulled the bad wheel), but consider whether a Severity: Critical / Exploitability: time-bounded note would help downstream readers understand the exposure model.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin","id":"GHSA-98x5-vq43-vc5p","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"supply_chain","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.1.15"],"introduced":["0.1.8"],"last_affected":[],"package":"semantic-router","purl":null,"source":"GHSA-98x5-vq43-vc5p"},{"ecosystem":"PyPI","fixed":["0.1.15"],"introduced":["0.1.8"],"last_affected":[],"package":"semantic-router","purl":"pkg:pypi/semantic-router","source":"GHSA-98x5-vq43-vc5p"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can steal credentials and execute code via a compromised dependency wheel installed by semantic-router users during a specific time window.","url":"https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/"}