GitHub Advisoryadvisory · PyPI

GHSA-38mg-wm59-g64x composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-8955
Ecosystem
PyPI
Packages
composio-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-643, CWE-918
Reviewed
2025-03-21

Affected packages

• PyPI composio-core: <= 0.4.4 (no fix yet)

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.

Related

Alias · CVE (1)

  • CVE-2024-8955 A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. vulnerability

Weakness · CWE (2)

  • CWE-643 Improper Neutralization of Data within XPath Expressions weakness
  • CWE-918 Server-Side Request Forgery weakness

References