PatchTheCVEcomposio vulnerabilities
Recent CVEs affecting composio products. 9 tracked.
composio has 9 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-12-04. Highest priority: CVE-2024-8958 (score 63/100).
- CVE-2025-56427 HIGH 7.5 DOWNGRADE Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive informat
- CVE-2024-8958 CRITICAL 9.8 DOWNGRADE In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the fileto
- CVE-2024-8955 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4
- CVE-2024-8954 CRITICAL 9.8 DOWNGRADE In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the aut
- CVE-2024-8953 CRITICAL 9.8 DOWNGRADE In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to
- CVE-2024-8952 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically
- CVE-2024-8865 LOW 3.5 UPGRADE A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic
- CVE-2024-8864 MEDIUM 5.5 UPGRADE A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical
- CVE-2024-53526 MEDIUM 6.4 DOWNGRADE composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep v
FAQ
How do I fix composio vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is composio being exploited right now?
None of the tracked composio CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which composio CVE should I patch first?
CVE-2024-8958 currently ranks highest (63/100): In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the fileto.