by Kastro
Paper/Archive/CVE-2024-8953

CVE-2024-8953

composiohq composiohq/composio — Unsafe eval usage in composiohq/composio

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.6.686 × 2013.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

Affected

ProductAffectedFixed inSource
composiohq/composiounspecified – latest–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
@huntr_ai (CNA)7.2CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploithuntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c