High
Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
Type: advisorySources: OSV
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59807
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 01:35 UTC · Revision 1
Source evidence
Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
core-osv · Original sourcePublished 8 Jul 2026, 19:43 UTC
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.
osv:CVE-2026-59807
Complete source record
{
"id": "01a78b1e89ce4a981d04675d097780c85adcf7ac96854ff9ad1513710832277e",
"url": "https://osv.dev/vulnerability/CVE-2026-59807",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts",
"summary": "Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.",
"evidence": "osv:CVE-2026-59807",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-59807",
"aliases": [
"CVE-2026-59807"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/composiohq/composio",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.2.32-beta.283"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.2.32-beta.283"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"@composio/cli@0.2.32-beta.282",
"@composio/cli@0.2.32-beta.281",
"@composio/cli@0.2.32-beta.280",
"@composio/cli@0.2.32-beta.279",
"py@0.17.1",
"py@0.17.0",
"@composio/slim@0.13.1",
"@composio/vercel@0.11.0",
"@composio/mastra@0.10.1",
"@composio/core@0.13.1",
"@composio/cli@0.2.32-beta.278",
"@composio/cli@0.2.32-beta.277",
"@composio/cli@0.2.32-beta.276",
"@composio/cli@0.2.32-beta.275",
"@composio/core@0.13.0",
"@composio/ts-builders@0.2.0",
"@composio/vercel@0.10.0",
"@composio/openai@0.10.0",
"@composio/openai-agents@0.10.0",
"@composio/mastra@0.10.0",
"@composio/llamaindex@0.10.0",
"@composio/langchain@0.10.0",
"@composio/json-schema-to-zod@0.2.0",
"@composio/google@0.10.0",
"@composio/core@0.12.0",
"@composio/cloudflare@0.10.0",
"@composio/cli@0.2.32-beta.274",
"@composio/cli-local-tools@0.1.0",
"@composio/cli-keyring@0.2.0",
"@composio/claude-agent-sdk@0.10.0",
"@composio/anthropic@0.10.0",
"py@0.16.0",
"@composio/cli@0.2.32-beta.273",
"@composio/cli@0.2.32-beta.272",
"@composio/cli@0.2.32-beta.271",
"@composio/cli@0.2.32-beta.270",
"@composio/cli@0.2.32-beta.269",
"@composio/cli@0.2.32-beta.268",
"@composio/vercel@0.9.3",
"@composio/openai@0.9.3",
"@composio/openai-agents@0.9.3",
"@composio/mastra@0.9.3",
"@composio/llamaindex@0.9.3",
"@composio/langchain@0.9.3",
"@composio/google@0.9.3",
"@composio/core@0.11.0",
"@composio/cloudflare@0.9.3",
"@composio/cli@0.2.32-beta.267",
"@composio/cli-local-tools@0.0.5",
"@composio/claude-agent-sdk@0.9.3",
"@composio/anthropic@0.9.3",
"@composio/cli@0.2.32-beta.266",
"py@0.15.0",
"@composio/cli@0.2.32-beta.265",
"@composio/cli@0.2.32-beta.264",
"@composio/cli@0.2.32-beta.263",
"@composio/cli@0.2.31-beta.259",
"@composio/cli@0.2.31",
"0.2.31",
"@composio/cli@0.2.31-beta.256",
"@composio/cli@0.2.31-beta.255",
"@composio/cli@0.2.31-beta.254",
"@composio/cli@0.2.31-beta.253",
"@composio/cli@0.2.31-beta.252",
"py@0.13.1",
"@composio/cli@0.2.31-beta.251",
"@composio/vercel@0.9.2",
"@composio/openai@0.9.2",
"@composio/openai-agents@0.9.2",
"@composio/mastra@0.9.2",
"@composio/llamaindex@0.9.2",
"@composio/langchain@0.9.2",
"@composio/google@0.9.2",
"@composio/core@0.10.0",
"@composio/cloudflare@0.9.2",
"@composio/cli@0.2.31-beta.250",
"@composio/cli@0.2.30",
"@composio/cli-local-tools@0.0.4",
"@composio/claude-agent-sdk@0.9.2",
"@composio/anthropic@0.9.2",
"@composio/cli@0.2.30-beta.249",
"@composio/cli@0.2.30-beta.248",
"@composio/cli@0.2.30-beta.247",
"@composio/cli@0.2.30-beta.246",
"@composio/cli@0.2.30-beta.245",
"@composio/vercel@0.9.1",
"@composio/openai@0.9.1",
"@composio/openai-agents@0.9.1",
"@composio/mastra@0.9.1",
"@composio/llamaindex@0.9.1",
"@composio/langchain@0.9.1",
"@composio/google@0.9.1",
"@composio/core@0.9.1",
"@composio/cloudflare@0.9.1",
"@composio/cli@0.2.29-beta.244",
"@composio/cli@0.2.29",
"@composio/cli-local-tools@0.0.3",
"@composio/claude-agent-sdk@0.9.1",
"@composio/anthropic@0.9.1",
"@composio/cli@0.2.29-beta.243",
"py@0.13.0",
"@composio/vercel@0.9.0",
"@composio/openai@0.9.0",
"@composio/openai-agents@0.9.0",
"@composio/mastra@0.9.0",
"@composio/llamaindex@0.9.0",
"@composio/langchain@0.9.0",
"@composio/google@0.9.0",
"@composio/core@0.9.0",
"@composio/cloudflare@0.9.0",
"@composio/cli@0.2.29-beta.242",
"@composio/cli-local-tools@0.0.2",
"@composio/cli-keyring@0.1.0",
"@composio/claude-agent-sdk@0.9.0",
"@composio/anthropic@0.9.0",
"@composio/cli@0.2.29-beta.241",
"@composio/cli@0.2.29-beta.240",
"@composio/cli@0.2.29-beta.239",
"@composio/cli@0.2.29-beta.238",
"@composio/cli@0.2.28-beta.223",
"@composio/cli@0.2.28",
"@composio/core@0.8.1",
"@composio/cli@0.2.27",
"@composio/claude-agent-sdk@0.8.1",
"@composio/cli@0.2.27-beta.222",
"@composio/cli@0.2.27-beta.221",
"py@0.12.0",
"@composio/cli@0.2.27-beta.220",
"@composio/cli@0.2.27-beta.219",
"@composio/cli@0.2.26-beta.217",
"@composio/cli@0.2.26",
"@composio/vercel@0.6.11",
"@composio/openai@0.6.11",
"@composio/openai-agents@0.6.11",
"@composio/mastra@0.6.11",
"@composio/llamaindex@0.6.11",
"@composio/langchain@0.6.11",
"@composio/google@0.6.11",
"@composio/core@0.6.11",
"@composio/cloudflare@0.6.11",
"@composio/cli@0.2.25-beta.216",
"@composio/cli@0.2.25",
"@composio/claude-agent-sdk@0.6.11",
"@composio/anthropic@0.6.11",
"py@0.11.6",
"@composio/cli@0.2.25-beta.212",
"@composio/cli@0.2.25-beta.215",
"@composio/cli@0.2.25-beta.214",
"@composio/cli@0.2.25-beta.213",
"@composio/cli@0.2.25-beta.211",
"@composio/cli@0.2.24-beta.209",
"@composio/cli@0.2.24",
"@composio/cli@0.2.23",
"@composio/cli@0.2.23-beta.207",
"@composio/cli@0.2.23-beta.206",
"@composio/cli@0.2.23-beta.205",
"@composio/cli@0.2.23-beta.202",
"@composio/cli@0.2.23-beta.199",
"@composio/vercel@0.6.10",
"@composio/openai@0.6.10",
"@composio/openai-agents@0.6.10",
"@composio/mastra@0.6.10",
"@composio/llamaindex@0.6.10",
"@composio/langchain@0.6.10",
"@composio/google@0.6.10",
"@composio/core@0.6.10",
"@composio/cloudflare@0.6.10",
"@composio/cli@0.2.22-beta.198",
"@composio/cli@0.2.22",
"@composio/claude-agent-sdk@0.6.10",
"@composio/anthropic@0.6.10",
"py@0.11.5",
"@composio/vercel@0.6.9",
"@composio/openai@0.6.9",
"@composio/openai-agents@0.6.9",
"@composio/mastra@0.6.9",
"@composio/llamaindex@0.6.9",
"@composio/langchain@0.6.9",
"@composio/google@0.6.9",
"@composio/core@0.6.9",
"@composio/cloudflare@0.6.9",
"@composio/cli@0.2.21-beta.197",
"@composio/cli@0.2.21",
"@composio/claude-agent-sdk@0.6.9",
"@composio/anthropic@0.6.9",
"@composio/cli@0.2.21-beta.196",
"@composio/cli@0.2.21-beta.195",
"@composio/cli@0.2.20-beta.192",
"@composio/cli@0.2.20",
"@composio/cli@0.2.21-beta.194",
"@composio/cli@0.2.20-beta.191",
"@composio/cli@0.2.20-beta.190",
"@composio/cli@0.2.20-beta.186",
"@composio/cli@0.2.20-beta.185",
"@composio/cli@0.2.20-beta.184",
"@composio/cli@0.2.20-beta.182",
"@composio/vercel@0.6.8",
"@composio/openai@0.6.8",
"@composio/openai-agents@0.6.8",
"@composio/mastra@0.6.8",
"@composio/llamaindex@0.6.8",
"@composio/langchain@0.6.8",
"@composio/google@0.6.8",
"@composio/core@0.6.8",
"@composio/cloudflare@0.6.8",
"@composio/cli@0.2.19",
"@composio/claude-agent-sdk@0.6.8",
"@composio/anthropic@0.6.8",
"@composio/cli@0.2.18",
"@composio/cli@0.2.17",
"@composio/cli@0.2.16-beta.20260331034020",
"@composio/cli@0.2.16-beta.20260331011658",
"@composio/cli@0.2.16",
"@composio/cli@0.2.15",
"@composio/cli@0.2.14-bun-bundle.20260327.1845",
"@composio/cli@0.2.14-bundled-mcp.1",
"@composio/cli@0.2.14-bundle-acp.1",
"@composio/cli@0.2.14-buildtime-acp.1",
"@composio/cli@0.2.14",
"@composio/cli@0.2.13-bundle-acp.2",
"@composio/cli@0.2.13-bundle-acp.1",
"@composio/cli@0.2.13",
"@composio/cli@0.2.11-binary-test.20260327.1",
"@composio/cli@0.2.12",
"@composio/cli@0.2.10-beta.3",
"@composio/cli@0.2.10-beta.2",
"@composio/cli@0.2.11",
"@composio/cli@0.2.10-beta.1",
"@composio/cli@0.2.10",
"@composio/cli@0.2.9",
"py@0.11.4",
"@composio/vercel@0.6.7",
"@composio/openai@0.6.7",
"@composio/openai-agents@0.6.7",
"@composio/mastra@0.6.7",
"@composio/llamaindex@0.6.7",
"@composio/langchain@0.6.7",
"@composio/google@0.6.7",
"@composio/core@0.6.7",
"@composio/cloudflare@0.6.7",
"@composio/cli@0.2.8",
"@composio/claude-agent-sdk@0.6.7",
"@composio/anthropic@0.6.7",
"@composio/vercel@0.6.6",
"@composio/openai@0.6.6",
"@composio/openai-agents@0.6.6",
"@composio/mastra@0.6.6",
"@composio/llamaindex@0.6.6",
"@composio/langchain@0.6.6",
"@composio/google@0.6.6",
"@composio/core@0.6.6",
"@composio/cloudflare@0.6.6",
"@composio/cli@0.2.7",
"@composio/claude-agent-sdk@0.6.6",
"@composio/anthropic@0.6.6",
"@composio/cli@0.2.6",
"@composio/cli@0.2.5",
"@composio/cli@0.2.4",
"py@0.11.3",
"@composio/cli@0.2.3",
"@composio/cli@0.2.2",
"@composio/cli@0.2.1",
"@composio/cli@0.2.0",
"py@0.11.2",
"@composio/vercel@0.6.4",
"@composio/openai@0.6.4",
"@composio/openai-agents@0.6.4",
"@composio/mastra@0.6.4",
"@composio/llamaindex@0.6.4",
"@composio/langchain@0.6.4",
"@composio/google@0.6.4",
"@composio/core@0.6.4",
"@composio/cloudflare@0.6.4",
"@composio/cli@0.1.35",
"@composio/claude-agent-sdk@0.6.4",
"@composio/anthropic@0.6.4",
"@composio/cli@0.1.34",
"@composio/cli@0.1.33",
"@composio/cli@0.1.32",
"@composio/cli@0.1.31",
"@composio/cli@0.1.30",
"@composio/cli@0.1.29",
"@composio/cli@0.1.28",
"@composio/cli@0.1.27",
"@composio/cli@0.1.26",
"v0.11.1",
"@composio/vercel@0.6.3",
"@composio/openai@0.6.3",
"@composio/openai-agents@0.6.3",
"@composio/mastra@0.6.3",
"@composio/llamaindex@0.6.3",
"@composio/langchain@0.6.3",
"@composio/google@0.6.3",
"@composio/core@0.6.3",
"@composio/cloudflare@0.6.3",
"@composio/claude-agent-sdk@0.6.3",
"@composio/anthropic@0.6.3",
"@composio/vercel@0.6.2",
"@composio/openai@0.6.2",
"@composio/openai-agents@0.6.2",
"@composio/mastra@0.6.2",
"@composio/llamaindex@0.6.2",
"@composio/langchain@0.6.2",
"@composio/json-schema-to-zod@0.1.20",
"@composio/google@0.6.2",
"@composio/core@0.6.2",
"@composio/cloudflare@0.6.2",
"@composio/claude-agent-sdk@0.6.2",
"@composio/anthropic@0.6.2",
"@composio/vercel@0.6.1",
"@composio/openai@0.6.1",
"@composio/openai-agents@0.6.1",
"@composio/mastra@0.6.1",
"@composio/llamaindex@0.6.1",
"@composio/langchain@0.6.1",
"@composio/google@0.6.1",
"@composio/core@0.6.1",
"@composio/cloudflare@0.6.1",
"@composio/claude-agent-sdk@0.6.1",
"@composio/anthropic@0.6.1",
"v0.11.0",
"@composio/vercel@0.5.5",
"@composio/openai@0.5.5",
"@composio/openai-agents@0.5.5",
"@composio/mastra@0.5.5",
"@composio/llamaindex@0.5.5",
"@composio/langchain@0.5.5",
"@composio/google@0.5.5",
"@composio/core@0.5.5",
"@composio/cloudflare@0.5.5",
"@composio/claude-agent-sdk@0.5.5",
"@composio/anthropic@0.5.5",
"@composio/vercel@0.5.4",
"@composio/openai@0.5.4",
"@composio/openai-agents@0.5.4",
"@composio/mastra@0.5.4",
"@composio/llamaindex@0.5.4",
"@composio/langchain@0.5.4",
"@composio/google@0.5.4",
"@composio/core@0.5.4",
"@composio/cloudflare@0.5.4",
"@composio/claude-agent-sdk@0.5.4",
"@composio/anthropic@0.5.4",
"@composio/vercel@0.5.3",
"@composio/openai@0.5.3",
"@composio/openai-agents@0.5.3",
"@composio/mastra@0.5.3",
"@composio/llamaindex@0.5.3",
"@composio/langchain@0.5.3",
"@composio/google@0.5.3",
"@composio/core@0.5.3",
"@composio/cloudflare@0.5.3",
"@composio/claude-agent-sdk@0.5.3",
"@composio/anthropic@0.5.3",
"@composio/vercel@0.5.2",
"@composio/openai@0.5.2",
"@composio/openai-agents@0.5.2",
"@composio/mastra@0.5.2",
"@composio/llamaindex@0.5.2",
"@composio/langchain@0.5.2",
"@composio/google@0.5.2",
"@composio/core@0.5.2",
"@composio/cloudflare@0.5.2",
"@composio/claude-agent-sdk@0.5.2",
"@composio/anthropic@0.5.2",
"@composio/vercel@0.5.1",
"@composio/openai@0.5.1",
"@composio/openai-agents@0.5.1",
"@composio/mastra@0.5.1",
"@composio/llamaindex@0.5.1",
"@composio/langchain@0.5.1",
"@composio/google@0.5.1",
"@composio/core@0.5.1",
"@composio/cloudflare@0.5.1",
"@composio/claude-agent-sdk@0.5.1",
"@composio/anthropic@0.5.1",
"v0.10.6",
"@composio/vercel@1.0.0",
"@composio/openai-agents@1.0.0",
"@composio/mastra@1.0.0",
"@composio/llamaindex@1.0.0",
"@composio/langchain@1.0.0",
"@composio/google@1.0.0",
"@composio/core@0.5.0",
"@composio/cloudflare@1.0.0",
"@composio/claude-agent-sdk@1.0.0",
"@composio/anthropic@1.0.0",
"v0.10.5",
"@composio/vercel@0.4.0",
"@composio/openai@0.4.0",
"@composio/openai-agents@0.4.0",
"@composio/mastra@0.4.0",
"@composio/llamaindex@0.4.0",
"@composio/langchain@0.4.0",
"@composio/google@0.4.0",
"@composio/core@0.4.0",
"@composio/cloudflare@0.4.0",
"@composio/claude-agent-sdk@0.4.0",
"@composio/anthropic@0.4.0",
"v0.10.4",
"@composio/vercel@0.3.4",
"@composio/openai@0.3.4",
"@composio/openai-agents@0.3.4",
"@composio/mastra@0.3.4",
"@composio/llamaindex@0.3.4",
"@composio/langchain@0.3.4",
"@composio/google@0.3.4",
"@composio/core@0.3.4",
"@composio/cloudflare@0.3.4",
"@composio/claude-agent-sdk@0.3.4",
"@composio/anthropic@0.3.4",
"@composio/claude-agent-sdk@0.3.3",
"@composio/vercel@0.3.3",
"@composio/openai@0.3.3",
"@composio/openai-agents@0.3.3",
"@composio/mastra@0.3.3",
"@composio/llamaindex@0.3.3",
"@composio/langchain@0.3.3",
"@composio/google@0.3.3",
"@composio/core@0.3.3",
"@composio/cloudflare@0.3.3",
"@composio/claude-code-agents@0.3.3",
"@composio/anthropic@0.3.3",
"v0.10.2",
"@composio/vercel@0.3.2",
"@composio/openai@0.3.2",
"@composio/openai-agents@0.3.2",
"@composio/mastra@0.3.2",
"@composio/llamaindex@0.3.2",
"@composio/langchain@0.3.2",
"@composio/google@0.3.2",
"@composio/core@0.3.2",
"@composio/cloudflare@0.3.2",
"@composio/claude-code-agents@0.3.2",
"@composio/anthropic@0.3.2",
"@composio/claude-code-agents@0.3.1",
"@composio/vercel@0.3.1",
"@composio/openai@0.3.1",
"@composio/openai-agents@0.3.1",
"@composio/mastra@0.3.1",
"@composio/llamaindex@0.3.1",
"@composio/langchain@0.3.1",
"@composio/google@0.3.1",
"@composio/core@0.3.1",
"@composio/cloudflare@0.3.1",
"@composio/anthropic@0.3.1",
"v0.10.1",
"v0.10.0",
"@composio/vercel@0.2.19-alpha.4",
"@composio/openai@0.2.7-alpha.4",
"@composio/openai-agents@0.2.7-alpha.4",
"@composio/mastra@0.2.7-alpha.4",
"@composio/llamaindex@0.2.7-alpha.4",
"@composio/langchain@0.2.7-alpha.4",
"@composio/google@0.2.7-alpha.4",
"@composio/core@0.2.7-alpha.4",
"@composio/cloudflare@0.2.7-alpha.4",
"@composio/anthropic@0.2.7-alpha.4",
"@composio/vercel@0.2.19-alpha.3",
"@composio/openai@0.2.7-alpha.3",
"@composio/openai-agents@0.2.7-alpha.3",
"@composio/mastra@0.2.7-alpha.3",
"@composio/llamaindex@0.2.7-alpha.3",
"@composio/langchain@0.2.7-alpha.3",
"@composio/google@0.2.7-alpha.3",
"@composio/core@0.2.7-alpha.3",
"@composio/cloudflare@0.2.7-alpha.3",
"@composio/anthropic@0.2.7-alpha.3",
"@composio/vercel@0.2.19-alpha.2",
"@composio/openai@0.2.7-alpha.2",
"@composio/openai-agents@0.2.7-alpha.2",
"@composio/mastra@0.2.7-alpha.2",
"@composio/llamaindex@0.2.7-alpha.2",
"@composio/langchain@0.2.7-alpha.2",
"@composio/google@0.2.7-alpha.2",
"@composio/core@0.2.7-alpha.2",
"@composio/cloudflare@0.2.7-alpha.2",
"@composio/anthropic@0.2.7-alpha.2",
"v0.9.5-rc.1",
"v0.9.4",
"@composio/vercel@0.2.17",
"@composio/openai@0.2.5",
"@composio/openai-agents@0.2.5",
"@composio/mastra@0.2.5",
"@composio/llamaindex@0.2.5",
"@composio/langchain@0.2.5",
"@composio/google@0.2.5",
"@composio/core@0.2.5",
"@composio/cloudflare@0.2.5",
"@composio/anthropic@0.2.5",
"v0.9.3",
"v0.9.2",
"@composio/vercel@0.2.16",
"@composio/openai@0.2.4",
"@composio/openai-agents@0.2.4",
"@composio/mastra@0.2.4",
"@composio/llamaindex@0.2.4",
"@composio/langchain@0.2.4",
"@composio/google@0.2.4",
"@composio/core@0.2.4",
"@composio/cloudflare@0.2.4",
"@composio/anthropic@0.2.4",
"v0.9.1",
"@composio/vercel@0.2.15",
"@composio/openai@0.2.3",
"@composio/openai-agents@0.2.3",
"@composio/mastra@0.2.3",
"@composio/llamaindex@0.2.3",
"@composio/langchain@0.2.3",
"@composio/google@0.2.3",
"@composio/core@0.2.3",
"@composio/cloudflare@0.2.3",
"@composio/anthropic@0.2.3",
"@composio/vercel@0.2.14",
"@composio/openai@0.2.2",
"@composio/openai-agents@0.2.2",
"@composio/mastra@0.2.2",
"@composio/llamaindex@0.2.2",
"@composio/langchain@0.2.2",
"@composio/json-schema-to-zod@0.1.18",
"@composio/google@0.2.2",
"@composio/core@0.2.2",
"@composio/cloudflare@0.2.2",
"@composio/anthropic@0.2.2",
"@composio/vercel@0.2.13",
"@composio/openai@0.2.1",
"@composio/openai-agents@0.2.1",
"@composio/mastra@0.2.1",
"@composio/llamaindex@0.2.1",
"@composio/langchain@0.2.1",
"@composio/google@0.2.1",
"@composio/core@0.2.1",
"@composio/cloudflare@0.2.1",
"@composio/anthropic@0.2.1",
"v0.9.0",
"@composio/vercel@0.2.12",
"@composio/openai@0.2.0",
"@composio/openai-agents@0.2.0",
"@composio/mastra@0.2.0",
"@composio/llamaindex@0.2.0",
"@composio/langchain@0.2.0",
"@composio/json-schema-to-zod@0.1.17",
"@composio/google@0.2.0",
"@composio/core@0.2.0",
"@composio/cloudflare@0.2.0",
"@composio/anthropic@0.2.0",
"@composio/vercel@0.2.11",
"@composio/openai@0.1.55",
"@composio/openai-agents@0.1.56",
"@composio/mastra@0.1.56",
"@composio/llamaindex@0.1.55",
"@composio/langchain@0.1.55",
"@composio/json-schema-to-zod@0.1.16",
"@composio/google@0.1.55",
"@composio/core@0.1.55",
"@composio/cloudflare@0.1.55",
"@composio/anthropic@0.1.55",
"@composio/vercel@0.2.10",
"@composio/openai@0.1.54",
"@composio/openai-agents@0.1.55",
"@composio/mastra@0.1.55",
"@composio/llamaindex@0.1.54",
"@composio/langchain@0.1.54",
"@composio/google@0.1.54",
"@composio/core@0.1.54",
"@composio/cloudflare@0.1.54",
"@composio/anthropic@0.1.54",
"@composio/llamaindex@0.1.53",
"v0.8.20",
"v0.8.19",
"v0.8.18",
"v0.8.17",
"v0.8.16",
"@composio/vercel@0.2.9",
"@composio/openai@0.1.53",
"@composio/openai-agents@0.1.54",
"@composio/mastra@0.1.54",
"@composio/langchain@0.1.53",
"@composio/google@0.1.53",
"@composio/core@0.1.53",
"@composio/cloudflare@0.1.53",
"@composio/anthropic@0.1.53",
"v0.8.15",
"0.8.14",
"v0.8.13",
"@composio/vercel@0.2.8",
"@composio/openai@0.1.52",
"@composio/openai-agents@0.1.53",
"@composio/mastra@0.1.53",
"@composio/langchain@0.1.52",
"@composio/google@0.1.52",
"@composio/core@0.1.52",
"@composio/cloudflare@0.1.52",
"@composio/anthropic@0.1.52",
"v0.8.12",
"v0.8.11",
"@composio/openai-agents@0.1.52",
"@composio/vercel@0.2.7",
"@composio/openai@0.1.51",
"@composio/openai-agents@0.1.51",
"@composio/mastra@0.1.52",
"@composio/langchain@0.1.51",
"@composio/google@0.1.51",
"@composio/core@0.1.51",
"@composio/cloudflare@0.1.51",
"@composio/anthropic@0.1.51",
"v0.8.10",
"0.8.10",
"@composio/vercel@0.2.4",
"@composio/openai@0.1.48",
"@composio/openai-agents@0.1.48",
"@composio/mastra@0.1.49",
"@composio/langchain@0.1.48",
"@composio/google@0.1.48",
"@composio/core@0.1.48",
"@composio/cloudflare@0.1.48",
"@composio/anthropic@0.1.48",
"v0.8.9",
"@composio/vercel@0.2.3",
"@composio/openai@0.1.47",
"@composio/openai-agents@0.1.47",
"@composio/mastra@0.1.48",
"@composio/langchain@0.1.47",
"@composio/google@0.1.47",
"@composio/core@0.1.47",
"@composio/cloudflare@0.1.47",
"@composio/anthropic@0.1.47",
"@composio/vercel@0.2.2",
"@composio/openai@0.1.46",
"@composio/openai-agents@0.1.46",
"@composio/mastra@0.1.47",
"@composio/langchain@0.1.46",
"@composio/google@0.1.46",
"@composio/core@0.1.46",
"@composio/cloudflare@0.1.46",
"@composio/anthropic@0.1.46",
"@composio/vercel@0.2.0",
"@composio/mastra@0.1.45",
"@composio/vercel@0.1.44",
"@composio/openai@0.1.44",
"@composio/openai-agents@0.1.44",
"@composio/mastra@0.1.44",
"@composio/langchain@0.1.44",
"@composio/google@0.1.44",
"@composio/core@0.1.44",
"@composio/cloudflare@0.1.44",
"@composio/anthropic@0.1.44",
"v0.8.8",
"@composio/vercel@0.1.43",
"@composio/openai@0.1.43",
"@composio/openai-agents@0.1.43",
"@composio/mastra@0.1.43",
"@composio/langchain@0.1.43",
"@composio/google@0.1.43",
"@composio/core@0.1.43",
"@composio/cloudflare@0.1.43",
"@composio/anthropic@0.1.43",
"@composio/vercel@0.1.41",
"@composio/openai@0.1.41",
"@composio/openai-agents@0.1.41",
"@composio/mastra@0.1.41",
"@composio/langchain@0.1.41",
"@composio/google@0.1.41",
"@composio/core@0.1.41",
"@composio/cloudflare@0.1.41",
"@composio/anthropic@0.1.41",
"v0.8.7",
"@composio/vercel@0.1.40",
"@composio/openai@0.1.40",
"@composio/openai-agents@0.1.40",
"@composio/mastra@0.1.40",
"@composio/langchain@0.1.40",
"@composio/google@0.1.40",
"@composio/core@0.1.40",
"@composio/cloudflare@0.1.40",
"@composio/anthropic@0.1.40",
"v0.8.6",
"cli@0.1.25",
"@composio/vercel@0.1.38",
"@composio/openai@0.1.38",
"@composio/openai-agents@0.1.38",
"@composio/mastra@0.1.38",
"@composio/langchain@0.1.38",
"@composio/google@0.1.38",
"@composio/core@0.1.38",
"@composio/cloudflare@0.1.38",
"@composio/anthropic@0.1.38",
"v0.8.5",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"@composio/vercel@0.1.37",
"@composio/openai@0.1.37",
"@composio/openai-agents@0.1.37",
"@composio/mastra@0.1.37",
"@composio/langchain@0.1.37",
"@composio/google@0.1.37",
"@composio/core@0.1.37",
"@composio/cloudflare@0.1.37",
"@composio/anthropic@0.1.37",
"v0.8.1",
"v0.8.0",
"py@1.0.0-rc10",
"py@1.0.0-rc9",
"py@1.0.0-rc8",
"py@1.0.0-rc7",
"py@1.0.0-rc6",
"cli@0.1.24-7",
"cli@0.1.24-1",
"cli@0.1.24-6",
"cli@0.1.24-5",
"cli@0.1.24-2",
"cli@0.1.24",
"py@1.0.0-rc5",
"@composio/vercel@0.1.31",
"@composio/openai@0.1.31",
"@composio/openai-agents@0.1.31",
"@composio/mastra@0.1.31",
"@composio/langchain@0.1.31",
"@composio/google@0.1.31",
"@composio/core@0.1.31",
"@composio/cloudflare@0.1.31",
"@composio/anthropic@0.1.31",
"@composio/vercel@0.1.30",
"@composio/openai@0.1.30",
"@composio/openai-agents@0.1.30",
"@composio/mastra@0.1.30",
"@composio/langchain@0.1.30",
"@composio/google@0.1.30",
"@composio/core@0.1.30",
"@composio/cloudflare@0.1.30",
"@composio/anthropic@0.1.30",
"@composio/vercel@0.1.29",
"@composio/openai@0.1.29",
"@composio/openai-agents@0.1.29",
"@composio/mastra@0.1.29",
"@composio/langchain@0.1.29",
"@composio/google@0.1.29",
"@composio/core@0.1.29",
"@composio/cloudflare@0.1.29",
"@composio/anthropic@0.1.29",
"@composio/vercel@0.1.28",
"@composio/openai@0.1.28",
"@composio/openai-agents@0.1.28",
"@composio/mastra@0.1.28",
"@composio/langchain@0.1.28",
"@composio/google@0.1.28",
"@composio/core@0.1.28",
"@composio/cloudflare@0.1.28",
"@composio/anthropic@0.1.28",
"py@1.0.0-rc4",
"@composio/vercel@0.1.27",
"@composio/openai@0.1.27",
"@composio/openai-agents@0.1.27",
"@composio/mastra@0.1.27",
"@composio/langchain@0.1.27",
"@composio/google@0.1.27",
"@composio/core@0.1.27",
"@composio/cloudflare@0.1.27",
"@composio/anthropic@0.1.27",
"py@1.0.0-rc3",
"@composio/vercel@0.1.26",
"@composio/openai@0.1.26",
"@composio/openai-agents@0.1.26",
"@composio/mastra@0.1.26",
"@composio/langchain@0.1.26",
"@composio/google@0.1.26",
"@composio/core@0.1.26",
"@composio/cloudflare@0.1.26",
"@composio/anthropic@0.1.26",
"py@1.0.0-rc2",
"@composio/vercel@0.1.24",
"@composio/openai@0.1.24",
"@composio/openai-agents@0.1.24",
"@composio/mastra@0.1.24",
"@composio/langchain@0.1.24",
"@composio/google@0.1.24",
"@composio/core@0.1.24",
"@composio/cloudflare@0.1.24",
"@composio/anthropic@0.1.24",
"@composio/vercel@0.1.23",
"@composio/openai@0.1.23",
"@composio/openai-agents@0.1.23",
"@composio/mastra@0.1.23",
"@composio/langchain@0.1.23",
"@composio/google@0.1.23",
"@composio/core@0.1.23",
"@composio/cloudflare@0.1.23",
"@composio/anthropic@0.1.23",
"@composio/vercel@0.1.22",
"@composio/openai@0.1.22",
"@composio/openai-agents@0.1.22",
"@composio/mastra@0.1.22",
"@composio/langchain@0.1.22",
"@composio/google@0.1.22",
"@composio/core@0.1.22",
"@composio/cloudflare@0.1.22",
"@composio/anthropic@0.1.22",
"@composio/vercel@0.1.21",
"@composio/openai@0.1.21",
"@composio/mastra@0.1.21",
"@composio/langchain@0.1.21",
"@composio/json-schema-to-zod@0.1.9",
"@composio/google@0.1.21",
"@composio/core@0.1.21",
"@composio/cloudflare@0.1.21",
"@composio/anthropic@0.1.21",
"@composio/vercel@0.1.20",
"@composio/openai@0.1.20",
"@composio/mastra@0.1.20",
"@composio/langchain@0.1.20",
"@composio/json-schema-to-zod@0.1.8",
"@composio/google@0.1.20",
"@composio/core@0.1.20",
"@composio/cloudflare@0.1.20",
"@composio/anthropic@0.1.20",
"@composio/vercel@0.1.19",
"@composio/openai@0.1.19",
"@composio/mastra@0.1.19",
"@composio/langchain@0.1.19",
"@composio/json-schema-to-zod@0.1.7",
"@composio/google@0.1.19",
"@composio/core@0.1.19",
"@composio/cloudflare@0.1.19",
"@composio/anthropic@0.1.19",
"@composio/vercel@0.1.18",
"@composio/openai@0.1.18",
"@composio/mastra@0.1.18",
"@composio/langchain@0.1.18",
"@composio/json-schema-to-zod@0.1.6",
"@composio/google@0.1.18",
"@composio/core@0.1.18",
"@composio/cloudflare@0.1.18",
"@composio/anthropic@0.1.18",
"@composio/vercel@0.1.17",
"@composio/openai@0.1.17",
"@composio/mastra@0.1.17",
"@composio/langchain@0.1.17",
"@composio/json-schema-to-zod@0.1.5",
"@composio/google@0.1.17",
"@composio/core@0.1.17",
"@composio/cloudflare@0.1.17",
"@composio/anthropic@0.1.17"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59807.json"
}
}
],
"modified": "2026-10-28T02:30:45.785409983Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59807.json",
"https://github.com/ComposioHQ/composio/releases/tag/%40composio%2Fcli%400.2.32-beta.283",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59807",
"https://www.vulncheck.com/advisories/composio-sdk-beta-283-sensitive-file-upload-via-tool-file-uploads-ts",
"https://github.com/ComposioHQ/composio/pull/3763",
"https://github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a",
"https://github.com/ComposioHQ/composio",
"https://github.com/ComposioHQ/composio/issues/3746"
],
"provider_metadata": {
"cwe_ids": [
"CWE-73"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59807.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59807",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 513908,
"published_at": "2026-07-08T19:43:51.506+00:00"
}