semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Date: 2026-06
Affected: pip/semantic-router
Attack vector: data-exfiltration
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-506

## Impact semantic-router versions 0.1.8 through 0.1.14 declare `litellm>=1.61.3` with no upper bound. During the window in which `litellm==1.82.8` was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel. The malicious `litellm==1.82.8` wheel ships a `litellm_init.pth` file that executes on Python interpreter startup — no import required. It collects and exfiltrates: - Process environment variables - AWS / GCP / Azure credentials - SSH keys, Kubernetes configs, shell history - Database credentials and CI/CD secrets - Cryptocurrency wallets Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to `https://models.litellm.cloud/`. See upstream: [BerriAI/litellm#24512](https://github.com/BerriAI/litellm/issues/24512) and [CVE-2026-42208](https://www.cve.org/CVERecord?id=CVE-2026-42208). ## Patches Fixed in **semantic-router 0.1.15**, which raises the floor to `litellm>=1.83.7`. ## Workarounds If developers cannot upgrade immediately: - Pin `litellm>=1.83.7,!=1.82.8` explicitly in their own project. - Audit `site-packages/` for `litellm_init.pth` and delete if present. - Rotate any credentials reachable from environments where an affected install ran. ## Credit Upstream report and triage by the litellm maintainers — see issue [#24512](https://github.com/BerriAI/litellm/issues/24512). One caveat before publishing CVE-2026-42208 specifically names 1.82.8. Pip's resolv


Mitigations:

Architectural layers (MAESTRO):