CVE-2026-37007
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Vulnerability in the FileWriterTool component of crewai-tools <= 1.10.2rc1. A remote attacker can achieve code execution via malicious path traversal sequences in the filename argument.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially leading to execution of malicious code and full system compromise.
Recommendation
Update crewai-tools to a patched version. Ensure file paths are properly validated and do not allow traversal outside allowed directories.
Other vulnerabilities in crewai-tools
See all- CVE-2026-112308High
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
- CVE-2026-37009Medium
SQL injection vulnerability in the NL2SQLTool component of crewai-tools v1.10.2rc1. A remote attacker can execute arbitrary SQL commands via an unsanitized sql_query argument.
Original NVD description (English source)
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS