GHSA-98x5-vq43-vc5p

Source

https://github.com/advisories/GHSA-98x5-vq43-vc5p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-98x5-vq43-vc5p/GHSA-98x5-vq43-vc5p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-98x5-vq43-vc5p

Downstream

MINI (11)

Published

2026-06-26T20:51:20Z

Modified

2026-06-26T21:00:09Z

Summary

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Details

Impact

semantic-router versions 0.1.8 through 0.1.14 declare litellm>=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel.

The malicious litellm==1.82.8 wheel ships a litellm_init.pth file that executes on Python interpreter startup — no import required. It collects and exfiltrates:

Process environment variables
AWS / GCP / Azure credentials
SSH keys, Kubernetes configs, shell history
Database credentials and CI/CD secrets
Cryptocurrency wallets

Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to https://models.litellm.cloud/.

See upstream: BerriAI/litellm#24512 and CVE-2026-42208.

Patches

Fixed in semantic-router 0.1.15, which raises the floor to litellm>=1.83.7.

Workarounds

If developers cannot upgrade immediately:

Pin litellm>=1.83.7,!=1.82.8 explicitly in their own project.
Audit site-packages/ for litellm_init.pth and delete if present.
Rotate any credentials reachable from environments where an affected install ran.

Credit

Upstream report and triage by the litellm maintainers — see issue #24512.

One caveat before publishing

CVE-2026-42208 specifically names 1.82.8. Pip's resolver picks "latest matching", so the real affected blast radius for semantic-router is users who ran pip install during the window that 1.82.8 was on PyPI — not everyone who ever installed 0.1.8–0.1.14. The advisory is still correct (an affected install could have pulled the bad wheel), but consider whether a Severity: Critical / Exploitability: time-bounded note would help downstream readers understand the exposure model.

Database specific

{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-26T20:51:20Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / semantic-router

Package

Name: semantic-router; View open source insights on deps.dev
Purl: pkg:pypi/semantic-router

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.1.8

Fixed

0.1.15

Affected versions

0.*

0.1.8

0.1.9

0.1.10

0.1.11

0.1.12

0.1.13

0.1.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-98x5-vq43-vc5p/GHSA-98x5-vq43-vc5p.json"