PT-2024-39282 · Composiohq · Composio

Aftersnow · CVE-2024-8864 · Published 2024-09-14 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: composiohq composio versions up to 0.5.6

Description: A critical vulnerability has been found in composiohq composio, affecting the Calculator function of the file python/composio/tools/local/mathematical/actions/calculator.py. This issue leads to code injection. The exploit has been disclosed to the public and may be used. There have been reports of offensive activities targeting this vulnerability. The vendor was contacted about this disclosure but did not respond.

Recommendations: For versions up to 0.5.6, patch immediately and review logs for signs of exploit. As a temporary workaround, consider disabling the Calculator function until a patch is available. Restrict access to the python/composio/tools/local/mathematical/actions/calculator.py file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-8864

GHSA-MRMH-3HQH-PFW7

PYSEC-2026-1266

Affected Products

Composio

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8864.json · Exploit
• 🔥 https://rumbling-slice-eb0.notion.site/Composio-s-Local-tools-Mathematical-has-a-code-injection-risk-in-composiohq-composio-ea0e89ee10fe4edfb9a8cfeed158c765?pvs=4 · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-1266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8864 · Security Note
• https://osv.dev/vulnerability/GHSA-mrmh-3hqh-pfw7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8864 · Vendor Advisory
• https://github.com/ComposioHQ/composio · Note
• https://github.com/ComposioHQ/composio/blob/v0.5.6/python/composio/tools/local/mathematical/actions/calculator.py#L29 · Note
• https://t.me/cvenotify/94652 · Telegram Post
• https://vuldb.com/?submit.403204 · Note
• https://twitter.com/vuldb/status/1835163769129099353 · Twitter Post
• https://github.com/advisories/GHSA-mrmh-3hqh-pfw7 · Note
• https://twitter.com/cracbot/status/1837008839331418518 · Twitter Post
• https://t.me/cvenotify/94885 · Telegram Post
• https://vuldb.com/?id.277501 · Note