{"action":"Upgrade semantic-router to 0.1.15 or later.","affected":[{"fixed":"0.1.15","introduced":"0.1.8"}],"component":"semantic-router","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.1.15"],"ghsa_id":"GHSA-98x5-vq43-vc5p","id":"tcs_01M5KFA9WSNTN7HQE02M2RYX5T","modified_at":"2026-06-26T21:00:09.577554093Z","published_at":"2026-06-26T20:51:20Z","references":["https://osv.dev/vulnerability/GHSA-98x5-vq43-vc5p","https://github.com/aurelio-labs/semantic-router/security/advisories/GHSA-98x5-vq43-vc5p","https://github.com/aurelio-labs/semantic-router"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-98x5-vq43-vc5p","url":"https://osv.dev/vulnerability/GHSA-98x5-vq43-vc5p"}],"summary":"semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin"}