---
id: CVE-2024-8953
aliases:
  - GHSA-5xg7-5662-8x7j
  - PYSEC-2026-1264
title: Composio Eval Injection Vulnerability
summary: Composio Eval Injection Vulnerability
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
vendor: composio-core
product: composio-core
ecosystem: pip
affected:
  - composio-core < 0.5.43
patched:
  - composio-core 0.5.43
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5xg7-5662-8x7j'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8953'
  - url: >-
      https://github.com/ComposioHQ/composio/commit/ed82fb45dc9fbd7f07c535c72bada871c158ae5f
  - url: 'https://github.com/ComposioHQ/composio-js'
  - url: >-
      https://github.com/ComposioHQ/composio/blob/b932d99e67f0fe95f8a0a24be9352e3f99059bc3/python/composio/tools/local/mathematical/actions/calculator.py#L37
  - url: 'https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c'
tags:
  - osv
  - pip
epss: 0.01214
epssPercentile: 0.67231
ingestedAt: '2026-07-08T18:25:46.245Z'
---

## Overview

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

## Affected packages

- `composio-core < 0.5.43`

## Remediation

Upgrade to a patched release:

- `composio-core 0.5.43`