Description
A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2024-09-15
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2838 A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Github GHSA Github GHSA GHSA-mrmh-3hqh-pfw7 Composio Code Injection Vulnerability
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00087}

 epss

{'score': 0.00102}

Tue, 17 Sep 2024 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Composio
Composio composio
CPEs cpe:2.3:a:composio:composio:*:*:*:*:*:*:*:*
Vendors & Products Composio
Composio composio

Tue, 17 Sep 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Composiohq
Composiohq composio
CPEs cpe:2.3:a:composiohq:composio:*:*:*:*:*:*:*:*
Vendors & Products Composiohq
Composiohq composio
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 15 Sep 2024 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title composiohq composio calculator.py Calculator code injection
Weaknesses CWE-94
References
Metrics cvssV2_0

{'score': 5.2, 'vector': 'AV:A/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Composio Composio
Composiohq Composio
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2024-09-16T20:20:11.603Z

Reserved: 2024-09-14T05:56:20.856Z

Link: CVE-2024-8864

cve-icon Vulnrichment

Updated: 2024-09-16T20:20:06.425Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-15T01:15:10.153

Modified: 2024-09-17T10:38:13.410

Link: CVE-2024-8864

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses