Code Injection Affecting composio-core package, versions [0,]
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-COMPOSIOCORE-7981553
- published 15 Sep 2024
- disclosed 15 Sep 2024
- credit Aftersnows
Introduced: 15 Sep 2024
CVE-2024-8864 Open this link in a new tabHow to fix?
Upgrade composio-core to version or higher.
Overview
composio-core is a Core package to act as a bridge between composio platform and other services.
Affected versions of this package are vulnerable to Code Injection in the Calculator class, which passes arbitrary input to the eval() function.
PoC
task = "Calculate __import__('os').system('touch ./hack.txt')"
agent_executor.invoke({"input": task})