CVE-2024-8958 is a critical (CVSS 9.8) unrestricted file read and write flaw in the filetools actions of composiohq/composio 0.4.3. File paths are not validated, so files anywhere on the server can be read or written. The record names no fixed release, so upgrade after checking the project's notes.
What's affected
The record names composiohq/composio version 0.4.3 and its filetools actions, which let an agent read and write files. The description says that, because file paths are not properly validated, an attacker can read and write files anywhere on the server, which could lead to privilege escalation or remote code execution.
The weakness is mapped to unrestricted upload of a dangerous file type, and the wording in the record is about unrestricted file write and read. In practice it means the actions did not keep file access inside a working folder.
No fixed release is named and the huntr report could not be read automatically, so confirm a fixed version in the Composio release notes. The related record CVE-2024-8953 describes code execution through eval in the same version.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show composio
pip list | grep -i composio
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for composio and read the pinned version.
Review which agents or services expose the file actions and which operating system account runs them. List what that account can read, such as ssh keys, cloud credentials and application configuration.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- Find composio installs at 0.4.3 and nearby versions.
- Upgrade to a newer release and check the notes for path validation changes.
- Disable filetools actions you do not need.
- Confine file actions to a dedicated working directory in a container or sandbox.
- Remove secrets from any account that runs agent tools, and rotate any that were reachable.
- Log file actions so that unusual paths are visible.
Why it matters
File tools for agents are powerful by design, and the safe version of them works inside a fenced folder. Without the fence, a path that points anywhere is honored, so an instruction hidden in a document the agent reads can become a request to read a key file or overwrite a startup script.
The class is improper path handling leading to arbitrary file access. The fix pattern is to resolve each path, compare it with an allowed root and refuse the rest, and to run the tool in an environment where even an escape finds nothing valuable.
The weakness class is CWE-434: Unrestricted Upload of File with Dangerous Type. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Can file write lead to code execution?
The record says it could, for example by overwriting files that the system later runs.
What is the best containment?
Run file actions in a sandbox with a single working folder and no secrets.
Sources
Last reviewed: 19 October 2026.
