{"data":{"id":"8dd8c966-e9d2-4632-9116-2e827c93a373","title":"CVE-2026-59807: Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and…","summary":"CVE-2026-59807 affects the Composio SDK before 0.2.32-beta.283. A missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts lets attackers use prompt injection to manipulate file_uploadable parameters, pointing them at sensitive paths such as SSH private keys. The CLI then uploads those credential files to attacker-controlled storage. VulnCheck rates the issue CVSS 4.0 8.9 (HIGH), and NIST has not yet provided an NVD assessment.","solution":"Fixed in @composio/cli 0.2.32-beta.283, per the linked release and commit references.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59807","publishedAt":"2026-07-08T20:16:57.123Z","cveId":"CVE-2026-59807","cweIds":["CWE-73"],"cvssScore":"6.8","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Composio SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Composio SDK path validation bypass enables sensitive file read","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00367,"epssCheckedAt":"2026-10-14T12:12:42.415Z","kevDateAdded":null,"advisoryAliases":["GHSA-jj3x-ph33-pjc6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:56.943Z","patchAvailable":null,"disclosureDate":"2026-07-08T20:16:57.123Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"]}}