CVE-2024-53526
MEDIUMcomposio >=0.5.40 - Command Injection via handle_tool_calls Function
Title source: llmDescription
composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.
References (4)
Core 4
Core References
Exploit, Issue Tracking, Vendor Advisory
https://github.com/ComposioHQ/composio/issues/1073
Scores
CVSS v3
6.4
EPSS
0.0075
EPSS Percentile
73.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-77
Status
published
Products (4)
composio/composio
0.5.40
pypi/composio-claude
0.5.40 - 0.6.9PyPI
pypi/composio-julep
0.5.40 - 0.6.9PyPI
pypi/composio-openai
0.5.40 - 0.6.9PyPI
Published
Jan 08, 2025
Tracked Since
Feb 18, 2026