~ / search / GHSA-5xg7-5662-8x7j

GHSA-5xg7-5662-8x7j

Composio Eval Injection Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-8953

Packages

EcosystemPackageAffectedFixed in
PyPI composio-core < 0.5.43 0.5.43

Details

As written in the advisory (Markdown source, shown as plain text).

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

References

External links from the advisory. They lead to third-party sites.