PT-2025-12250 · Composio · Composio

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8953

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions composiohq/composio version 0.4.3

Description The issue concerns the use of the unsafe eval() function in the "mathematical calculator" endpoint to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

Recommendations For composiohq/composio version 0.4.3, consider disabling the mathematical calculator endpoint until a patch is available that replaces the eval() function with a safer alternative. Restrict access to this endpoint to minimize the risk of exploitation. Avoid passing untrusted input to the eval() function in the mathematical calculator endpoint.

Exploit

Fix

Weakness Enumeration

CWE-913

CWE-627

Related Identifiers

CVE-2024-8953

GHSA-5XG7-5662-8X7J

Affected Products

Composio

References · 8

• 🔥 https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8953 · Security Note
• https://osv.dev/vulnerability/GHSA-5xg7-5662-8x7j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8953 · Vendor Advisory
• https://github.com/ComposioHQ/composio/commit/ed82fb45dc9fbd7f07c535c72bada871c158ae5f · Note
• https://github.com/ComposioHQ/composio/blob/b932d99e67f0fe95f8a0a24be9352e3f99059bc3/python/composio/tools/local/mathematical/actions/calculator.py#L37 · Note
• https://github.com/ComposioHQ/composio-js · Note
• https://twitter.com/CVEnew/status/1902671050090942660 · Twitter Post