Quick answers
- Is CVE-2024-8955 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-8955 being exploited in the wild.
- How severe is CVE-2024-8955?
- Low severity, with a CVSS score of 3, published 7 July 2026.
- Which products and versions are affected?
- composio-core (PyPI) ECOSYSTEM:introduced=0,last_affected=0.4.4.
- Is there a fix for CVE-2024-8955?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-8955 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-8955?
- Check whether you run composio-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the composio-core library (CWE-918, CWE-643) affecting version 0.4.4 and likely all earlier versions. The vulnerability resides in the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions, which fail to properly validate or sanitize URLs before processing them. An authenticated attacker with high privileges can craft malicious requests using file:// or other protocol handlers to read arbitrary files from the filesystem. The vulnerability requires network access and high privilege level (PR:H), making it exploitable primarily by internal or privileged actors, not unauthenticated external users. A patch or update availability is not explicitly mentioned in the advisory.
Affected products
- ComposioHQ composio-core 0.1.82 through 0.4.4
Identifiers
- CVE-2024-8955
- GHSA-38mg-wm59-g64x
- PYSEC-2026-1263
Timeline
- 2025-03-20: disclosed
- 2025-03-20: advisory: GHSA-38mg-wm59-g64x published