CVE-2024-8864: Composio Code Injection Vulnerability

CVE-2024-8864 Overview

CVE-2024-8864 is a code injection vulnerability in the Calculator function of Composio, an open-source toolset for AI agents. The flaw resides in python/composio/tools/local/mathematical/actions/calculator.py and affects Composio versions up to 0.5.6. Attackers with low privileges on an adjacent network can manipulate calculator input to execute arbitrary Python code within the tool's runtime context. The issue is tracked under CWE-94: Improper Control of Generation of Code. The vendor was contacted about the disclosure but did not respond, and exploit details have been published.

Critical Impact
Adversaries can inject and execute arbitrary code through the Composio Calculator tool, compromising the confidentiality, integrity, and availability of the host process running the AI agent.

Affected Products

Composio composio versions up to and including 0.5.6
python/composio/tools/local/mathematical/actions/calculator.py module
AI agent deployments embedding the Composio local mathematical toolset

Discovery Timeline

2024-09-15 - CVE-2024-8864 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8864

Vulnerability Analysis

Composio exposes a local Calculator action intended to evaluate mathematical expressions supplied by an AI agent or user. The implementation in calculator.py passes attacker-controlled input to a Python evaluation primitive without sanitizing operators, function references, or dunder attributes. Because the calculator does not restrict the expression grammar to numeric operations, any valid Python expression executes with the privileges of the Composio process. The vulnerability is representative of a broader class of risks in large language model tooling, where natural-language inputs reach dynamic code evaluation paths.

Root Cause

The root cause is unsafe evaluation of untrusted expressions inside the calculator action. The function treats the input string as executable Python rather than restricting it to arithmetic tokens. Under [CWE-94], any construct that reaches the evaluator, including imports, attribute lookups, and built-in calls, runs in-process. No allowlist, abstract syntax tree (AST) validation, or sandbox isolates the mathematical operations from the wider Python runtime.

Attack Vector

Exploitation requires adjacent-network access and low privileges. An attacker who can submit prompts or tool invocations to a Composio-backed agent supplies a crafted expression to the Calculator action. The expression can reference Python built-ins such as __import__ to load modules like os and invoke commands, exfiltrate environment secrets, or pivot within the host. In agentic pipelines, indirect prompt injection from third-party content can also trigger the vulnerable tool call without direct attacker interaction.

No verified proof-of-concept code is published in the referenced advisories. See the Notion analysis on code injection and VulDB entry #277501 for additional technical detail.

Detection Methods for CVE-2024-8864

Indicators of Compromise

Calculator action inputs containing Python keywords such as import, __import__, eval, exec, open, or dunder attribute references like __builtins__.
Unexpected child processes spawned by the Python interpreter hosting the Composio agent, including shells, network utilities, or package managers.
Outbound network connections from the Composio process to previously unseen destinations shortly after tool invocations.
Filesystem reads of sensitive paths (for example /etc/passwd, .env, cloud credential files) originating from the agent process.

Detection Strategies

Log and inspect every argument passed to the Calculator tool and alert on tokens outside a numeric and operator allowlist.
Instrument the Python runtime with audit hooks (sys.addaudithook) to record exec, compile, and import events triggered by tool calls.
Correlate agent tool invocations with process, file, and network telemetry to detect anomalous behavior following mathematical actions.

Monitoring Recommendations

Baseline normal Calculator inputs and flag deviations in length, character set, or structural complexity.
Monitor the Composio dependency in software bills of materials (SBOMs) for versions at or below 0.5.6.
Aggregate agent runtime logs into a central analytics platform and retain them long enough to reconstruct multi-step exploitation.

How to Mitigate CVE-2024-8864

Immediate Actions Required

Inventory all deployments using composio and identify hosts running versions up to 0.5.6.
Disable or unregister the local mathematical Calculator action until a patched release is verified.
Restrict adjacent-network access to Composio agent endpoints through firewall rules and authenticated APIs.
Rotate any credentials or tokens accessible to the process account running Composio if exposure is suspected.

Patch Information

At the time of publication, no vendor advisory or fixed release is referenced in the NVD record for CVE-2024-8864. The reporter indicates the vendor did not respond to the disclosure. Track the composio project repository for future releases beyond 0.5.6 and validate any candidate build against the calculator action before redeployment.

Workarounds

Replace the vulnerable evaluator with a safe parser such as ast.literal_eval combined with an allowlisted operator set, or an arithmetic-only library.
Wrap the Composio process in an operating system sandbox (for example seccomp, AppArmor, or a minimal container) with no network egress and read-only filesystem where feasible.
Apply prompt and tool-input filters at the agent orchestration layer to reject expressions containing non-numeric Python constructs.
Run the agent under a dedicated low-privilege service account with no access to secrets, cloud metadata endpoints, or shared credentials.

bash

# Example: remove the vulnerable action from a Composio deployment
pip show composio
pip uninstall composio
# Reinstall only after verifying a patched release addresses calculator.py