Read the docs

composiohq

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

composiohq records in CISA KEV

No composiohq vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Composio 9 records HIGH

Records

10 records

TI-2024-08314 CVE-2024-8954 · GHSA-fhfg-frx8-7458

Authentication Bypass in composiohq/composio

Priority HIGH 82

In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00885 Published 2025-03-20 No fix listed CWE-304
TI-2024-08318 CVE-2024-8958 · GHSA-8fw3-c8jq-g74q

Unrestricted File Write and Read in composiohq/composio

Priority HIGH 76

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01422 Published 2025-03-20 No fix listed CWE-434
TI-2024-08313 CVE-2024-8953 · GHSA-5xg7-5662-8x7j

Unsafe eval usage in composiohq/composio

Priority HIGH 76

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01214 Published 2025-03-20 Fixed in 0.5.43 CWE-627
TI-2026-42628 CVE-2026-59807 · GHSA-jj3x-ph33-pjc6

Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts

Priority HIGH 72

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromD…

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00367 Published 2026-07-08 Fixed in 0.2.32-beta.283 CWE-73
TI-2024-08315 CVE-2024-8955 · GHSA-38mg-wm59-g64x

SSRF in composiohq/composio

Priority HIGH 66

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00741 Published 2025-03-20 No fix listed CWE-918
TI-2024-08312 CVE-2024-8952 · GHSA-qvg9-vp87-h3hr

SSRF in composiohq/composio

Priority HIGH 66

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00733 Published 2025-03-20 No fix listed CWE-918
TI-2024-08231 CVE-2024-8865 · GHSA-66r2-xm28-74w9

composiohq composio api.py path path traversal

Priority MEDIUM 56

A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic.

CVSS 4.0MEDIUM 5.1 Adjacent network Low privileges No interaction EPSS 0.0087 Published 2024-09-15 No fix listed CWE-22
Open these records in search →