CVE-2024-8952: SSRF in composiohq/composio

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-918

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.

Affected products

composiohq/composio: 0.4.2

References

https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2a
https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2a

Get alerted when CVE-2024-8952 or the next vulnerability affects your stack