Description
In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| composiohq | composiohq/composio | unspecified – ≤ latest | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | composio-core | < 0.5.43 | 0.5.43 | GHSA-5xg7-5662-8x7j |