Alberto Schiabel f926058147 fix(cli): refuse symlink entries when extracting archives (#4210)
Addresses the `pnpm audit --prod` warning that has been riding along on
recent CLI PRs: **`extract-zip` unvalidated symlink path traversal**,
[GHSA-jmr9-qjv8-65gv](https://github.com/advisories/GHSA-jmr9-qjv8-65gv)
/ CVE-2026-56876, high.

## There is no version to upgrade to

`pnpm audit` renders "Patched versions >=2.0.2", which reads like a bump
would fix it. It would not:

- `npm view extract-zip versions` ends at **2.0.1** — no 2.0.2 was ever
published
- the advisory itself records `"first_patched_version": null`

So `pnpm audit --fix --prod` cannot resolve this, and neither can a
version constraint.

## What the flaw actually is

I reproduced it rather than working from the summary. `extract-zip`
2.0.1 **does** block writes that traverse a symlink — an archive with
`link -> ../../ESCAPED` plus `link/pwned.txt` is refused with `Out of
bound path ... while processing file link/pwned.txt`, and nothing lands
outside the target.

What it does not do is validate the symlink itself. An archive whose
only entry is `escape-abs -> /tmp/ABSOLUTE-TARGET` extracts cleanly and
plants that dangling symlink in the output directory. Per the advisory:
*"Depending on how extract-zip is used, an attacker could read or write
to arbitrary files."* Every call site here extracts an archive and then
reads or copies files back out of the tree, which is exactly the shape
that turns a planted symlink into an arbitrary-path read.

## Why not swap the library

`#4183` moved tar extraction to `Bun.Archive`, so that was the obvious
candidate. It does not work: **`Bun.Archive` cannot read zip archives at
all.** A benign zip fails with `ReadError`, same as the malicious ones —
those "refusals" were read failures, not security. Verified before
ruling it out.

## Why not fix it upstream

Because it already is, three times over, and none of it has moved:

| PR | Date | Targets |
| --- | --- | --- |
|
[max-mapper/extract-zip#158](https://github.com/max-mapper/extract-zip/pull/158)
| 2026-08-14 | GHSA-jmr9-qjv8-65gv, this advisory |
| [#160](https://github.com/max-mapper/extract-zip/pull/160) |
2026-08-17 | CVE-2026-19693, symlink at the final path component |
| [#161](https://github.com/max-mapper/extract-zip/pull/161) |
2026-08-20 | CVE-2026-56876 again, and bumps the version to 2.0.2 |

All three are mergeable with zero review comments. The repository's last
commit to `master` was **August 2021**; 2.0.1 shipped June 2020. [Issue
#159](https://github.com/max-mapper/extract-zip/issues/159), a
downstream consumer asking whether a patched release is planned, has
three replies — every one from another stranded consumer, none from a
maintainer.

A fourth PR would not be a contribution. And our implementation is the
wrong shape to upstream regardless: refusing *every* symlink is right
for an application whose archives never carry one, but a breaking change
for a general-purpose library, where the correct fix is validating that
a link's resolved target stays inside the extraction root — which is
what #158 and #161 already do. Upstream even tracks "do not extract
symlinks" as a separate [feature
request](https://github.com/max-mapper/extract-zip/issues/140), open
since 2023.

So this is a deliberate local workaround on a timeline we control. The
helper's doc comment records the tracking PRs and the condition for
deleting it: a published release that actually carries the fix.

## The fix

No archive either package extracts — release binaries, companion assets,
skills, sidecar bundles — legitimately contains a symlink. So the entry
type is refused outright, via `extract-zip`'s own `onEntry` hook, which
runs **before** the entry is written. A rejected archive plants nothing.

All four call sites now go through it:

| package | call site |
| --- | --- |
| `cli` | `services/upgrade-binary.ts` |
| `cli` | `services/run-companion-modules.ts` |
| `cli` | `effects/install-skill.ts` |
| `cli-local-tools` | `src/bundled-binaries.ts` |

Each package carries its own copy of the helper rather than sharing one.
`run-companion-modules.ts` is bundled as a standalone companion module
and imports nothing from `@composio/cli-local-tools`; routing it through
that package to share ~15 lines would pull the local-tools tree into
those bundles.

## Verification

Committed three fixture archives (827 bytes total) and tested against
real zips, not mocks:

- benign archive extracts, contents intact
- `symlink-absolute.zip` (`-> /tmp/ABSOLUTE-TARGET`) refused, output
directory left empty
- `symlink-relative.zip` (`-> ../../outside`) refused, output directory
left empty
- `isSymlinkZipEntry` unit-tested across symlink, regular file,
directory, and Windows-authored entries with no Unix mode

**Mutation-checked:** neutering the predicate makes exactly the three
symlink tests fail and leaves the other four green, so the suite
genuinely detects the regression rather than passing by construction.

Suites: `@composio/cli` 123 files / 1263 passed,
`@composio/cli-local-tools` 7 files / 20 passed. Typecheck clean on
both. `pnpm validate:changesets` passes; note lands in
`ts/packages/cli/CHANGELOG.md`.

`extract-zip` stays as the dependency — it is still the only working zip
reader here, and with symlink entries refused the advisory's vector no
longer applies to this codebase.

https://claude.ai/code/session_01JkwtxPHfobZxzvAqe53x62
2026-08-23 12:28:24 +02:00
2025-09-28 04:02:01 +05:30
2025-06-16 19:52:20 +05:30
2025-11-13 21:18:45 +05:30

Composio logo

composio.dev • Documentation • Quickstart • Changelog

GitHub stars npm PyPI Discord HVTrust

Composio

Composio gives your AI agents 1000+ pre-authenticated toolkits, per-user sessions, authentication, triggers, and a sandbox, so you can ship agents that turn intent into action.

This is the Composio SDK monorepo. It contains:

  • @composio/core: TypeScript SDK
  • composio: Python SDK
  • composio CLI: search, execute, and script tools from your shell
  • Provider adapters for OpenAI Agents, Claude Agent SDK, Vercel AI SDK, LangChain, and more

Quickstart

Create a session for a user, hand its tools to your agent, and let the agent take action across 1000+ apps. Grab a COMPOSIO_API_KEY from the dashboard first.

TypeScript

npm install @composio/core @composio/openai-agents @openai/agents

@composio/core intentionally packages its TypeScript source and SDK docs so the installed package is inspectable to coding agents. If you want a smaller install with the same API, use @composio/slim.

import { Composio } from "@composio/core";
import { OpenAIAgentsProvider } from "@composio/openai-agents";
import { Agent, run } from "@openai/agents";

const composio = new Composio({ provider: new OpenAIAgentsProvider() });

// Each session is scoped to one of your users
const session = await composio.create("user_123");
const tools = await session.tools();

const agent = new Agent({
  name: "Personal Assistant",
  instructions: "You are a helpful assistant. Use Composio tools to take action.",
  tools,
});

const result = await run(agent, "Summarize my emails from today");
console.log(result.finalOutput);

Python

pip install composio composio-openai-agents openai-agents
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
from agents import Agent, Runner

composio = Composio(provider=OpenAIAgentsProvider())

# Each session is scoped to one of your users
session = composio.create(user_id="user_123")
tools = session.tools()

agent = Agent(
    name="Personal Assistant",
    instructions="You are a helpful assistant. Use Composio tools to take action.",
    tools=tools,
)

result = Runner.run_sync(starting_agent=agent, input="Summarize my emails from today")
print(result.final_output)

By default a session gets meta tools that discover, authenticate, and execute app tools at runtime, so you don't load hundreds of tool definitions into context. Store session.session_id and reuse it with composio.use() across turns. See what a session is and configuring sessions for restricting toolkits, auth configs, and connected accounts.

Prefer MCP? Every session also exposes a hosted MCP endpoint. Pass mcp: true to composio.create() and point Claude, Cursor, or any MCP client at session.mcp.url. See sessions via MCP.

CLI

The composio CLI runs Composio from your shell and gives coding agents like Claude Code a local tool surface.

curl -fsSL https://composio.dev/install | sh

The installer puts composio on your PATH for future terminals. Open a new terminal, then run composio login. See INSTALL.md for shell setup overrides, including COMPOSIO_INSTALL_SHELL=none for install-only runs.

Use composio search to find tools, composio execute to run them, composio link to connect accounts, and composio run to script workflows in TypeScript. See the CLI docs.

Providers

A provider adapts Composio tools to your agent framework's native tool format:

Provider TypeScript Python
OpenAI @composio/openai composio-openai
OpenAI Agents @composio/openai-agents composio-openai-agents
Anthropic @composio/anthropic composio-anthropic
Claude Agent SDK @composio/claude-agent-sdk composio-claude-agent-sdk
Vercel AI SDK @composio/vercel —
Google GenAI @composio/google composio-gemini, composio-google
Google ADK — composio-google-adk
LangChain @composio/langchain composio-langchain
LangGraph via @composio/langchain composio-langgraph
LlamaIndex @composio/llamaindex composio-llamaindex
Mastra @composio/mastra —
Pi @composio/experimental* —
Cloudflare Workers AI @composio/cloudflare —
CrewAI — composio-crewai
AutoGen — composio-autogen

* The Pi provider is experimental and ships from @composio/experimental.

Don't see your framework? Build a custom provider, or skip providers entirely and connect over MCP.

All packages

Everything published from this repo:

Package Description
@composio/core TypeScript SDK
@composio/slim @composio/core without packaged source or docs; same API, smaller install
composio CLI Standalone CLI binary: curl -fsSL https://composio.dev/install | sh
@composio/experimental Experimental integrations, including the Pi provider
@composio/json-schema-to-zod JSON Schema to Zod conversion
@composio/* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Vercel, Google, LangChain, LlamaIndex, Mastra, Cloudflare
composio Python SDK
composio-* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Gemini, Google, Google ADK, LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen

Repository layout

ts/                TypeScript SDK workspace
  packages/core/       @composio/core
  packages/providers/  Provider adapters
  packages/cli/        Composio CLI
python/            Python SDK and provider packages
docs/              Documentation site (docs.composio.dev)

The TypeScript SDK is tested against Node 22+; the Python SDK supports Python 3.10+.

Development

mise install    # pinned toolchain (Node, Python, pnpm)
pnpm install
pnpm build
pnpm test

Python commands run from python/; see python/README.md. We welcome contributions to both SDKs; read the contribution guidelines before submitting pull requests.

Support

License

MIT. See LICENSE.

S
Description
Route and complete Composio work across Composio For You and Composio Platform. Use when the user mentions Composio; wants an agent to use apps such as Gmail,…
Readme 1.3 GiB
Languages
TypeScript 72.2%
Python 23.3%
Shell 2.1%
JavaScript 2%
Swift 0.4%