composio-core 0.3.28 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the composio-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Directory Traversal composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Directory Traversal via the `_download_file_or_dir` function. An attacker can access sensitive files outside the intended directory by supplying crafted input paths. How to fix Directory Traversal? There is no fixed version for `composio-core`.	[0,)
H Dynamic Variable Evaluation composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Dynamic Variable Evaluation through the `eval` function in the `mathematical_calculator` endpoint. An attacker can execute arbitrary code by injecting malicious input into the function. How to fix Dynamic Variable Evaluation? Upgrade `composio-core` to version 0.5.43 or higher.	[,0.5.43)
M Server-side Request Forgery (SSRF) composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the `/api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT` endpoint. An attacker with high privileges can read files, access AWS metadata, and interact with local services on the system by sending crafted requests to the affected endpoint. How to fix Server-side Request Forgery (SSRF)? There is no fixed version for `composio-core`.	[0,)
M Improper Neutralization of Data within XPath Expressions ('XPath Injection') composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions ('XPath Injection') via the `BROWSERTOOL_GOTO_PAGE` and `BROWSERTOOL_GET_PAGE_DETAILS` actions. An attacker can read the contents of any file on the system by sending crafted requests. How to fix Improper Neutralization of Data within XPath Expressions ('XPath Injection')? There is no fixed version for `composio-core`.	[0,)
H Arbitrary Command Injection composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Arbitrary Command Injection via the `handle_tool_calls` function due to improper user input sanitization. How to fix Arbitrary Command Injection? Upgrade `composio-core` to version 0.6.9 or higher.	[,0.6.9)
M Arbitrary File Read composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Arbitrary File Read over the `/api/download` endpoint, which accepts a `file` parameter than can read any files accessible to the application user. How to fix Arbitrary File Read? Upgrade `composio-core` to version 0.5.0 or higher.	[,0.5.0)
M Code Injection composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Code Injection in the `Calculator` class, which passes arbitrary input to the `eval()` function. How to fix Code Injection? There is no fixed version for `composio-core`.	[0,)

Vulnerability

Vulnerable Version

Directory Traversal