PyPI/composio-core CVE-2024-8953: high 7.2, EPSS 1.21%
Composio Eval Injection Vulnerability
Action: Upgrade composio-core to 0.5.43 or later.
pip install composio-core==0.5.43Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.43 | - |
Fixed versions
| 0.5.43 |
Sources
- osv: GHSA-5xg7-5662-8x7j
- https://nvd.nist.gov/vuln/detail/CVE-2024-8953
- https://github.com/ComposioHQ/composio/commit/ed82fb45dc9fbd7f07c535c72bada871c158ae5f
- https://github.com/ComposioHQ/composio-js
- https://github.com/ComposioHQ/composio/blob/b932d99e67f0fe95f8a0a24be9352e3f99059bc3/python/composio/tools/local/mathematical/actions/calculator.py#L37
- https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c
CVE-2024-8953 · published · modified · JSON