CVE-2024-8953 is a critical (CVSS 9.8) code execution flaw in composiohq/composio 0.4.3. The mathematical_calculator endpoint passes its input to Python's eval() function, so untrusted input can run as code. The record names no fixed release, so upgrade past 0.4.3 after checking the release notes.
What's affected
The record names composiohq/composio version 0.4.3, a toolkit that connects AI agents to outside tools. The affected component is the mathematical_calculator endpoint, which uses the Python eval() function to compute results.
The description says this can lead to arbitrary code execution if untrusted input reaches eval(). In an agent setting, input often comes from a model or from a user prompt, which makes the word untrusted important: text produced by a language model can be steered by whoever controls the prompt or the documents the model reads.
A fixed version is not named in the record, and we could not read the huntr report. A second Composio record in this range, CVE-2024-8958, covers file access in the same version.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show composio
pip list | grep -i composio
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for composio and read the pinned version.
Then search your code, and any Composio tool definitions you run, for eval( and for the calculator action. Check whether the service that exposes the action is reachable from outside a trusted network.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- Find composio installs at 0.4.3 and nearby versions.
- Upgrade to a newer release and confirm in the notes that the calculator action no longer uses eval.
- Disable the calculator action if you do not need it.
- Replace any eval in your own code with a safe expression parser or the ast.literal_eval function for plain literals.
- Run agent tool servers in a sandbox with no secrets and limited network access.
- Review CVE-2024-8958 for the same project.
Why it matters
Python's eval() runs text as code. It is a poor fit for a calculator, because a string that looks like arithmetic can contain anything that Python can run. The class in the record is dynamic code evaluation.
The safe pattern for math is a small parser that accepts numbers and a fixed set of operators, and nothing else. Agent tool code deserves extra suspicion. Inputs are generated by a model, can be shaped by hostile content the model reads, and often reach code that runs with the permissions of the agent host. Treat every tool argument as untrusted input.
The weakness class is CWE-627: Dynamic Variable Evaluation, CWE-913: Improper Control of Dynamically-Managed Code Resources. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does this matter for AI agents?
Tool arguments come from a model, and the model can be influenced by untrusted text. That makes every tool input untrusted.
What is the safe alternative to eval for math?
A parser that allows only numbers and set operators.
Sources
Last reviewed: 19 October 2026.
