# GHSA-98x5-vq43-vc5p: semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

> Attackers can steal credentials and execute code via a compromised dependency wheel installed by semantic-router users during a specific time window.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 26 Jun 2026

## What is GHSA-98x5-vq43-vc5p?

GHSA-98x5-vq43-vc5p is a vulnerability in semantic-router, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

## Impact
semantic-router versions 0.1.8 through 0.1.14 declare `litellm>=1.61.3` with no upper bound. During the window in which `litellm==1.82.8` was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel.

The malicious `litellm==1.82.8` wheel ships a `litellm_init.pth` file that executes on Python interpreter startup — no import required. It collects and exfiltrates:
- Process environment variables
- AWS / GCP / Azure credentials
- SSH keys, Kubernetes configs, shell history
- Database credentials and CI/CD secrets
- Cryptocurrency wallets

Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to `https://models.litellm.cloud/`.

See upstream: [BerriAI/litellm#24512](https://github.com/BerriAI/litellm/issues/24512) and [CVE-2026-42208](https://www.cve.org/CVERecord?id=CVE-2026-42208).

## Patches
Fixed in **semantic-router 0.1.15**, which raises the floor to `litellm>=1.83.7`.

## Workarounds
If developers cannot upgrade immediately:
- Pin `litellm>=1.83.7,!=1.82.8` explicitly in their own project.
- Audit `site-packages/` for `litellm_init.pth` and delete if present.
- Rotate any credentials reachable from environments where an affected install ran.

## Credit
Upstream report and triage by the litellm maintainers — see issue [#24512](https://github.com/BerriAI/litellm/issues/24512).

One caveat before publishing

CVE-2026-42208 specifically names 1.82.8. Pip's resolver picks "latest matching", so the real affected blast radius for semantic-router is users who ran pip install during the window that 1.82.8 was on PyPI — not everyone who ever installed 0.1.8–0.1.14. The advisory is still correct (an affected install could have pulled the bad wheel), but consider whether a Severity: Critical / Exploitability: time-bounded note would help downstream readers understand the exposure model.

## Which versions are affected by GHSA-98x5-vq43-vc5p?

2 open source packages ship an affected version, including semantic-router.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `semantic-router` | PyPI | From 0.1.8 | 0.1.15 |
| `semantic-router` | PyPI | From 0.1.8 | 0.1.15 |

## How do I fix GHSA-98x5-vq43-vc5p?

Upgrade semantic-router to 0.1.15 or later.

## Is GHSA-98x5-vq43-vc5p being exploited?

There is no known exploitation of GHSA-98x5-vq43-vc5p in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-98x5-vq43-vc5p and fix it if it is affected.

What it is: GHSA-98x5-vq43-vc5p is a vulnerability in semantic-router, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-98x5-vq43-vc5p in the wild and no public exploit code.

Affected packages and fixed versions:
- semantic-router (PyPI): affected from 0.1.8; fixed in 0.1.15
- semantic-router (PyPI): affected from 0.1.8; fixed in 0.1.15

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/ (Markdown: https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-98x5-vq43-vc5p

---
From sbomify Insights: https://insights.sbomify.com/GHSA-98x5-vq43-vc5p/
Summaries are generated and may contain mistakes; the official description above is the record.