Vulnerabilities

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromD…

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions.

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint.

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations.

In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step.

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4.

composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.

A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic.

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical.