GitHub Advisoryadvisory · PyPI

GHSA-qvg9-vp87-h3hr composio Server-Side Request Forgery (SSRF) vulnerability

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-8952
Ecosystem
PyPI
Packages
composio-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2025-03-21

Affected packages

• PyPI composio-core: <= 0.4.2 (no fix yet)

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.

Related

Alias · CVE (1)

  • CVE-2024-8952 A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References