CVE-2026-59807: Composio SDK Path Traversal Vulnerability

CVE-2026-59807 Overview

CVE-2026-59807 is a path validation bypass vulnerability in the Composio SDK affecting versions before 0.2.32-beta.283. The flaw resides in the readFileFromDisk function within tool-file-uploads.ts, which lacks an assertSafeFileUploadPath check. Attackers can leverage prompt injection to manipulate file_uploadable parameters and reference sensitive files such as SSH private keys. The Composio CLI then uploads those credential files to attacker-controlled storage. The vulnerability is classified under [CWE-73: External Control of File Name or Path].

Critical Impact
Remote attackers can exfiltrate SSH keys, tokens, and other credential files from developer workstations through prompt injection against AI agents using the Composio SDK.

Affected Products

Composio SDK versions before 0.2.32-beta.283
@composio/cli package prior to the security release
@composio/core package prior to the introduction of assertSafeFileUploadPath

Discovery Timeline

2026-07-08 - CVE-2026-59807 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59807

Vulnerability Analysis

The Composio SDK exposes tools that AI agents can invoke, including tools that upload local files to remote storage. The readFileFromDisk function in ts/packages/cli/src/services/tool-file-uploads.ts accepted arbitrary file paths passed through the file_uploadable parameter without any denylist enforcement. Any string an LLM produced in a tool call was resolved directly against the local filesystem.

Because AI agents commonly process untrusted content, an attacker who controls model input can inject instructions that coerce the agent into supplying paths like ~/.ssh/id_rsa, ~/.aws/credentials, or shell history files. The CLI reads the referenced file and forwards its contents through the upload workflow to a destination the attacker controls.

Root Cause

The root cause is a missing security control. The core package did not export a centralized guard, so downstream packages such as @composio/cli performed no path validation before invoking filesystem reads. This is an [CWE-73] external control of file name or path weakness compounded by the trust boundary between LLM-generated arguments and local file access.

Attack Vector

The attack chain begins with prompt injection delivered through any untrusted content the agent consumes: a web page, an email, a document, or a tool response. The injected instructions direct the agent to invoke a Composio file-upload tool with a file_uploadable value pointing at a sensitive file. The CLI reads the file locally and transmits it to a destination reachable by the attacker.

The following patch introduces the missing denylist guard in the core package:

typescript

} from './utils/jsonSchema';
export { getExtensionFromMimeType } from './utils/mime';
export { normalizeToolArguments } from './utils/toolArguments';
// Sensitive-file-upload denylist guard. This is the single canonical
// implementation; downstream packages (e.g. `@composio/cli`) import it here so
// every local-file upload path enforces the same denylist. Safe in the edge
// bundle: the module routes filesystem access through `#platform`.
export {
  assertSafeFileUploadPath,
  isBlockedSensitiveFileUploadPath,
  BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS,
} from './utils/sensitiveFileUploadPaths';
export {
  sanitizeSchemaPropertyKeys,
  restoreOriginalKeys,
// Source: https://github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a

The CLI-side patch imports and enforces the new guard before reading files:

typescript

import fs from 'node:fs/promises';
import path from 'node:path';
import type { Composio as RawComposioClient } from '@composio/client';
import { assertSafeFileUploadPath } from '@composio/core';
import { toolkitFromToolSlug } from 'src/utils/toolkit-from-tool-slug';

type JsonSchema = Record<string, unknown>;
// Source: https://github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a

Detection Methods for CVE-2026-59807

Indicators of Compromise

Outbound network activity from developer workstations containing .ssh, .aws, .kube, or .env path substrings in upload request bodies or logs
Composio CLI process reads of files under ~/.ssh/, ~/.aws/, ~/.gnupg/, or ~/.config/ that do not correspond to legitimate user actions
Unexpected file-upload tool calls in Composio SDK telemetry referencing dotfiles or credential stores

Detection Strategies

Audit LLM agent tool-call logs for file_uploadable arguments that reference paths outside a project working directory
Inspect installed Composio CLI versions across developer machines and flag any release older than 0.2.32-beta.283
Correlate process execution of node, composio, or agent runtimes with reads of sensitive credential files

Monitoring Recommendations

Enable command-line and file-access telemetry on developer endpoints running AI coding agents
Alert on Composio CLI network egress to unfamiliar hosts, particularly following prompt-injection-prone tool invocations
Track package manager events for installs of @composio/cli and @composio/core at vulnerable versions

How to Mitigate CVE-2026-59807

Immediate Actions Required

Upgrade @composio/cli and @composio/core to version 0.2.32-beta.283 or later immediately
Rotate any credentials that may have been exposed on hosts running vulnerable Composio SDK versions, including SSH keys, cloud credentials, and API tokens
Review agent execution logs for tool invocations referencing sensitive filesystem paths

Patch Information

The fix is delivered in Composio release @composio/cli@0.2.32-beta.283. The patch introduces assertSafeFileUploadPath in @composio/core and enforces it in the CLI's tool-file-uploads.ts. Details are available in the GitHub commit, pull request #3763, the release announcement, and the VulnCheck advisory.

Workarounds

Run Composio CLI and connected agents under a restricted user account with no read access to SSH keys or cloud credential files
Constrain agent workspaces using containers or filesystem sandboxing to isolate credentials from the process performing file uploads
Disable file-upload tools in Composio configurations until the patched version is deployed

bash

# Configuration example: upgrade the Composio CLI and core packages
npm install @composio/cli@0.2.32-beta.283 @composio/core@0.2.32-beta.283

# Verify the installed version
npx composio --version