CVE-2024-8953

The mathematical_calculator endpoint accepts user input and passes it directly to the eval() function to perform mathematical operations. The eval() function interprets the passed string as code and executes it in the application context. An attacker can craft a malicious payload instead of a mathematical expression and thus trigger arbitrary code execution on the server side.

An attacker without any privileges can remotely execute arbitrary code on the server (RCE), which may result in complete system takeover, data theft, backdoor installation, or service disruption.

Patches available from the vendor should be applied according to the references. It is recommended to replace the eval() function with a secure library for parsing mathematical expressions and implement strict validation and sanitization of input data on the server side.

Composio version 0.4.3