composio-core@0.6.7 vulnerabilities

Core package to act as a bridge between composio platform and other services.

0.6.19

9 months ago

10 hours ago

Known vulnerabilities in the composio-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Arbitrary Command Injection composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Arbitrary Command Injection via the `handle_tool_calls` function due to improper user input sanitization. How to fix Arbitrary Command Injection? Upgrade `composio-core` to version 0.6.9 or higher.	[,0.6.9)
M Code Injection composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Code Injection in the `Calculator` class, which passes arbitrary input to the `eval()` function. How to fix Code Injection? Upgrade `composio-core` to version or higher.	[0,)