What is GHSA-98X5-VQ43-VC5P?

GHSA-98X5-VQ43-VC5P is a critical-severity security vulnerability in semantic-router (pip), affecting versions >= 0.1.8, < 0.1.15. It is fixed in 0.1.15.

Which versions of semantic-router are affected by GHSA-98X5-VQ43-VC5P?

semantic-router (pip) versions >= 0.1.8, < 0.1.15 is affected.

Is there a fix for GHSA-98X5-VQ43-VC5P?

Yes. GHSA-98X5-VQ43-VC5P is fixed in 0.1.15. Upgrade to this version or later.

Is GHSA-98X5-VQ43-VC5P exploitable, and should I be worried?

Whether GHSA-98X5-VQ43-VC5P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-98X5-VQ43-VC5P is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-98X5-VQ43-VC5P?

Upgrade semantic-router to 0.1.15 or later.

GHSA-98X5-VQ43-VC5P in semantic-router

Q: Which versions of semantic-router are affected by GHSA-98X5-VQ43-VC5P?

semantic-router (pip) versions >= 0.1.8, < 0.1.15 is affected.

Q: Is there a fix for GHSA-98X5-VQ43-VC5P?

Yes. GHSA-98X5-VQ43-VC5P is fixed in 0.1.15. Upgrade to this version or later.

Q: Is GHSA-98X5-VQ43-VC5P exploitable, and should I be worried?

Whether GHSA-98X5-VQ43-VC5P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-98X5-VQ43-VC5P is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-98X5-VQ43-VC5P?

Upgrade semantic-router to 0.1.15 or later.

Summary

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Workarounds

If developers cannot upgrade immediately:

Pin litellm>=1.83.7,!=1.82.8 explicitly in their own project.
Audit site-packages/ for litellm_init.pth and delete if present.
Rotate any credentials reachable from environments where an affected install ran.

Credit

Upstream report and triage by the litellm maintainers, see issue #24512.

One caveat before publishing

CVE-2026-42208 specifically names 1.82.8. Pip's resolver picks "latest matching", so the real affected blast radius for semantic-router is users who ran pip install during the window that 1.82.8 was on PyPI, not everyone who ever installed 0.1.8–0.1.14. The advisory is still correct (an affected install could have pulled the bad wheel), but consider whether a Severity: Critical / Exploitability: time-bounded note would help downstream readers understand the exposure model.

Impact

semantic-router versions 0.1.8 through 0.1.14 declare litellm>=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel.

The malicious litellm==1.82.8 wheel ships a litellm_init.pth file that executes on Python interpreter startup, no import required. It collects and exfiltrates:

Process environment variables
AWS / GCP / Azure credentials
SSH keys, Kubernetes configs, shell history
Database credentials and CI/CD secrets
Cryptocurrency wallets

Stage-two payload encrypts the collected data (AES-256 + embedded RSA pubkey) and POSTs it to https://models.litellm.cloud/.

See upstream: BerriAI/litellm#24512 and CVE-2026-42208.

Affected versions

semantic-router (>= 0.1.8, < 0.1.15)

Security releases

semantic-router → 0.1.15 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fixed in semantic-router 0.1.15, which raises the floor to litellm>=1.83.7.

Frequently Asked Questions

What is GHSA-98X5-VQ43-VC5P? GHSA-98X5-VQ43-VC5P is a critical-severity security vulnerability in semantic-router (pip), affecting versions >= 0.1.8, < 0.1.15. It is fixed in 0.1.15.
Which versions of semantic-router are affected by GHSA-98X5-VQ43-VC5P? semantic-router (pip) versions >= 0.1.8, < 0.1.15 is affected.
Is there a fix for GHSA-98X5-VQ43-VC5P? Yes. GHSA-98X5-VQ43-VC5P is fixed in 0.1.15. Upgrade to this version or later.
Is GHSA-98X5-VQ43-VC5P exploitable, and should I be worried? Whether GHSA-98X5-VQ43-VC5P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-98X5-VQ43-VC5P is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-98X5-VQ43-VC5P? Upgrade semantic-router to 0.1.15 or later.