Security Digest · Critical advisory (no CVE assigned)
GHSA-98x5-vq43-vc5p: semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Impact semantic-router versions 0.1.8 through 0.1.14 declare litellm>=1.61.3 with no upper bound.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | semantic-router | >= 0.1.8, < 0.1.15 | 0.1.15 |
Details
Impact semantic-router versions 0.1.8 through 0.1.14 declare litellm>=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel.
The malicious litellm==1.82.8 wheel ships a litellminit.pth file that executes on Python interpreter startup — no import required. It collects and exfiltrates: - Process environment variables - AWS / GCP / Azure credentials - SSH keys, Kubernetes configs, shell history - Database credentials and CI/CD secrets - Cryptocurrency wallets
Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to https://models.litellm.cloud/.
See upstream: BerriAI/litellm#24512 and CVE-2026-42208.
Patches Fixed in semantic-router 0.1.15, which raises the floor to litellm>=1.83.7.
Workarounds If developers cannot upgrade immediately: - Pin litellm>=1.83.7,!=1.82.8 explicitly in their own project. - Audit site-packages/ for litellminit.pth and delete if present. - Rotate any credentials reachable from environments where an affected install ran.
Credit Upstream report and triage by the litellm maintainers — see issue #24512.
One caveat before publishing
Sources and references
- GitHub Advisory GHSA-98x5-vq43-vc5p github.com
- github.com github.com