UnratedPyPIAmendedPublished
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
GHSA-98x5-vq43-vc5p
- Affected
- PyPI semantic-router >= 0.1.8, < 0.1.15
- Fixed in
- 0.1.15· Vendor fix available
- Issue
- Impact semantic-router versions 0.1.8 through 0.1.14 declare litellm=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel. The malicious litellm==1.82.8 wheel ships a litellminit.pth file that executes on Python interpreter startup — no import required. It collects and exfiltrates: - Process environment variables - AWS / GCP / Azure credentials - SSH keys, Kubernetes configs, shell history - Database credentials and CI/CD secrets - Cryptocurrency wallets Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to https://models.litellm.cloud/. See upstream: BerriAI/litellm#24512 and CVE-2026-42208. Patches Fixed in semantic-router 0.1.15, which raises the floor to litellm=1.83.7. Workarounds If developers cannot upgrade immediately: - Pin litellm=1.83.7,!=1.82.8 explicitly in their own project. - Audit…
Recommended action: Upgrade to 0.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.