GCVE - cpe:2.3:a:composiohq:composiohq/composio:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:composiohq:composiohq/composio:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Composiohq (`44afcb2b-c482-5d63-97e2-819406d3d9fe`)
Product	Composiohq/Composio (`47b212cf-4f65-5fbf-942f-61d18b0d9ea3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-8958`	vulnerable	2026-06-08 07:00:26.222678	Unrestricted File Write and Read in composiohq/composio HIGH (7.2) In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution. Published: 2025-03-20T10:11:16.677Z Updated: 2025-03-20T13:12:51.449Z Open on db.gcve.eu Reference links https://huntr.com/bounties/e152b094-0593-428e-b813-068d2390ce68	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8955`	vulnerable	2026-06-08 07:00:26.203094	SSRF in composiohq/composio MEDIUM (6.8) A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions. Published: 2025-03-20T10:09:27.940Z Updated: 2025-10-15T12:50:43.991Z Open on db.gcve.eu Reference links https://huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8954`	vulnerable	2026-06-08 07:00:26.201411	Authentication Bypass in composiohq/composio CRITICAL (9.8) In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server. Published: 2025-03-20T10:10:15.583Z Updated: 2025-10-15T12:50:43.444Z Open on db.gcve.eu Reference links https://huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8953`	vulnerable	2026-06-08 07:00:26.199110	Unsafe eval usage in composiohq/composio HIGH (7.2) In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function. Published: 2025-03-20T10:10:56.507Z Updated: 2025-03-20T18:10:22.095Z Open on db.gcve.eu Reference links https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-8952`	vulnerable	2026-06-08 07:00:26.197720	SSRF in composiohq/composio MEDIUM (6.8) A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system. Published: 2025-03-20T10:10:59.130Z Updated: 2025-03-20T15:52:34.147Z Open on db.gcve.eu Reference links https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2a	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.