Composio 代码注入漏洞

Composio is a production-ready toolset for AI agents open-sourced by Composio. A code injection vulnerability exists in Composio version 0.5.6 and earlier. An attacker can inject arbitrary code by exploiting this vulnerability...

CVE-2024-8864: Improper Control of Generation of Code

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

CVE-2024-8865: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2024-39282

Name of the Vulnerable Software and Affected Versions: composiohq composio versions up to 0.5.6 Description: A critical vulnerability has been found in composiohq composio, affecting the Calculator function of the file python/composio/tools/local/mathematical/actions/calculator.py. This issue lea...