91 matches found
CVE-2026-84856
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launc...
EUVD-2026-70268
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launc...
CVE-2026-84856 rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launc...
CVE-2026-84856
rowboatlabs rowboat versions up to 0.9.1 are affected by a denial of service vulnerability in the Composio Webhook Endpoint (apps/rowboat/app/api/composio/webhook/route.ts), specifically in the request.text/req.json function. The attack is remotely exploitable with no authentication required. A p...
CVE-2026-84856 rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launc...
PT-2026-84867
Name of the Vulnerable Software and Affected Versions rowboatlabs rowboat versions prior to 0.9.2 Description A remote denial of service issue exists in the Composio Webhook Endpoint component. The problem occurs within the request.text/req.json functions located in the...
PYSEC-2026-2429 Composio Command Execution vulnerability
composio =0.5.40 is vulnerable to Command Execution in composioopenai, composioclaude, and composiojulep via the handletoolcalls function...
PYSEC-2026-2428 Composio Command Execution vulnerability
composio =0.5.40 is vulnerable to Command Execution in composioopenai, composioclaude, and composiojulep via the handletoolcalls function...
@aoagents/ao (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc), @aoagents/ao-cli (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc) +81 more potentially affected by CVE-2026-59807 via @composio/core (>=0.1.0-rc.3, <=0.13.1)
@composio/core NPM version =0.1.0-rc.3, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.0.2, =1.0.0, =0.1.0-rc.3, =4.4.0, =3.7.18, =3.7.18, =3.7.18, =3.7.18, =3.7.18,...
CVE-2026-59807
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
CVE-2026-59807
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
EUVD-2026-42377
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...
CVE-2026-59807
CVE-2026-59807 affects Composio SDK prior to 0.2.32-beta.283. A path validation bypass in readFileFromDisk (tool-file-uploads.ts) can enable an attacker to read and exfiltrate sensitive files by manipulating file_uploadable parameters via prompt injection, referencing sensitive paths such as SSH ...
PYSEC-2026-1263 composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...
PYSEC-2026-1264 Composio Eval Injection Vulnerability
In composiohq/composio version 0.4.3, the mathematicalcalculator endpoint uses the unsafe eval function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval function...
PYSEC-2026-1267 composio Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...