{"cve":"CVE-2024-53526","nvd":{"published":"2025-01-08T19:15:37.753","modified":"2026-06-17T08:08:57.770","status":"Analyzed","description":"composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4},"cwes":["CWE-77"],"references":["https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156","https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21","https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184","https://github.com/ComposioHQ/composio/issues/1073"],"products":["composio:composio"],"source":"nvd","synced_at":"2026-10-19T21:58:20.756570362+00:00"},"epss":{"cve":"CVE-2024-53526","score":0.00605,"percentile":0.48943,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8h93-28hg-fj84","url":"https://osv.dev/vulnerability/GHSA-8h93-28hg-fj84","summary":"Composio Command Execution vulnerability","modified":"2026-07-13T16:43:11.568757035Z","packages":[{"ecosystem":"PyPI","name":"composio-claude","purl":"pkg:pypi/composio-claude","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]},{"ecosystem":"PyPI","name":"composio-openai","purl":"pkg:pypi/composio-openai","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]},{"ecosystem":"PyPI","name":"composio-julep","purl":"pkg:pypi/composio-julep","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]}]},{"id":"PYSEC-2026-1268","url":"https://osv.dev/vulnerability/PYSEC-2026-1268","summary":"Composio Command Execution vulnerability","modified":"2026-07-13T16:43:11.568757035Z","packages":[{"ecosystem":"PyPI","name":"composio-julep","purl":"pkg:pypi/composio-julep","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]}]},{"id":"PYSEC-2026-2428","url":"https://osv.dev/vulnerability/PYSEC-2026-2428","summary":"Composio Command Execution vulnerability","modified":"2026-07-13T16:43:11.568757035Z","packages":[{"ecosystem":"PyPI","name":"composio-claude","purl":"pkg:pypi/composio-claude","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]}]},{"id":"PYSEC-2026-2429","url":"https://osv.dev/vulnerability/PYSEC-2026-2429","summary":"Composio Command Execution vulnerability","modified":"2026-07-13T16:43:11.568757035Z","packages":[{"ecosystem":"PyPI","name":"composio-openai","purl":"pkg:pypi/composio-openai","ranges":[">=0.5.40 <0.6.9"],"fixed":["0.6.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}