critical9.8
CVE-2024-8953
Composio Eval Injection Vulnerability
Impact
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | composio-core | < 0.5.43 | 0.5.43 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Composio | Composio | Version 0.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c
- https://github.com/advisories/GHSA-5xg7-5662-8x7j
- https://nvd.nist.gov/vuln/detail/CVE-2024-8953
- https://github.com/ComposioHQ/composio/commit/ed82fb45dc9fbd7f07c535c72bada871c158ae5f
- https://github.com/ComposioHQ/composio/blob/b932d99e67f0fe95f8a0a24be9352e3f99059bc3/python/composio/tools/local/mathematical/actions/calculator.py#L37