GHSA-8h93-28hg-fj84

Suggest an improvement
Source
https://github.com/advisories/GHSA-8h93-28hg-fj84
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8h93-28hg-fj84
Aliases
Published
2025-01-08T21:32:25Z
Modified
2026-07-13T16:43:11Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Composio Command Execution vulnerability
Details

composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.

Database specific 
{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-01-31T21:06:18Z",
    "nvd_published_at":  "2025-01-08T19:15:37Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / composio-claude

Package

Name
composio-claude
View open source insights on deps.dev
Purl
pkg:pypi/composio-claude

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.5.40
Fixed
0.6.9

Affected versions

0.*
0.5.40
0.5.41
0.5.42
0.5.43
0.5.44
0.5.45
0.5.46
0.5.47
0.5.48rc1
0.5.49
0.5.50
0.5.51rc1
0.5.51
0.5.52rc1
0.5.52rc2
0.6.0rc1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json"

PyPI / composio-openai

Package

Name
composio-openai
View open source insights on deps.dev
Purl
pkg:pypi/composio-openai

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.5.40
Fixed
0.6.9

Affected versions

0.*
0.5.40
0.5.41
0.5.42
0.5.43
0.5.44
0.5.45
0.5.46
0.5.47
0.5.48rc1
0.5.49
0.5.50
0.5.51rc1
0.5.51
0.5.52rc1
0.5.52rc2
0.6.0rc1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json"

PyPI / composio-julep

Package

Name
composio-julep
View open source insights on deps.dev
Purl
pkg:pypi/composio-julep

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.5.40
Fixed
0.6.9

Affected versions

0.*
0.5.40
0.5.41
0.5.42
0.5.43
0.5.44
0.5.45
0.5.46
0.5.47
0.5.48rc1
0.5.49
0.5.50
0.5.51rc1
0.5.51
0.5.52rc1
0.5.52rc2
0.6.0rc1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json"