PYSEC-2026-1267
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/composio-core/PYSEC-2026-1267.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1267
- Aliases
- Published
- 2026-07-07T14:34:57.747452Z
- Modified
- 2026-07-07T17:47:11.985649300Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- composio Server-Side Request Forgery (SSRF) vulnerability
- Details
-
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.
- References
Affected packages
PyPI / composio-core
Package
- Name
- composio-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/composio-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected0.4.2
Affected versions
0.*
0.1.82
0.1.83
0.1.84
0.1.87
0.1.88
0.1.89
0.1.90
0.1.91
0.1.92
0.1.93
0.1.94
0.1.95
0.1.96
0.1.97
0.1.98
0.1.99
0.1.100
0.1.101
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19
0.2.20
0.2.21
0.2.22
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36rc1
0.2.36rc2
0.2.36
0.2.37
0.2.38
0.2.39
0.2.40
0.2.41
0.2.44
0.2.46
0.2.47
0.2.48
0.2.49
0.2.50
0.2.51
0.2.52
0.2.54
0.2.55
0.2.56
0.2.59
0.2.60
0.2.63
0.2.64
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.9rc1
0.3.9rc2
0.3.9rc3
0.3.9rc4
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18rc0
0.3.18rc1
0.3.18rc2
0.3.18
0.3.19
0.3.20rc0
0.3.20rc1
0.3.20
0.3.22
0.3.23rc0
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27
0.3.28
0.3.29
0.3.30
0.4.0
0.4.1
0.4.2rc1
0.4.2rc2
0.4.2