CVE-2024-8953

Description

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-627 CWE-627

CWE-913 CWE-913

Affected Products

Vendor	Product	Versions
composio	composio	All

References

Exploits

https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c

Frequently Asked Questions

What is CVE-2024-8953? +

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-8953? +

CVE-2024-8953 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-8953? +

CVE-2024-8953 affects products from composio, specifically: composio. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-8953? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-31032 7.5

NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A …

CVE-2024-8954 9.8

In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows …

CVE-2024-8958 9.8

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper …

CVE-2024-8952 7.5

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an …

CVE-2024-8955 7.5

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents …

CVE-2025-56427 7.5

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.