CVE-2026-37008
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
Risk Assessment
An attacker can bypass the CrewAI sandbox, gaining access to Python's complete object graph and performing unauthorized operations, leading to takeover of the execution environment.
Recommendation
Update CrewAI to a version containing commit fb2323b or later; if that is not possible, do not rely on a within-process sandbox and use system-level isolation (containers, virtual machines).
Other vulnerabilities in CrewAI
See all- CVE-2026-120630Unknown
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
- CVE-2026-92206High
CrewAI contains a remote code execution vulnerability via unsafe reflection during agent loading. User interaction is required—the target must load a malicious agent configuration from the repository. The flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, allowing code execution in the context of the service account.
- CVE-2026-62240High
CrewAI before version 1.15.1 contains a server-side request forgery (SSRF) vulnerability in the validate_url function, which performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
Original NVD description (English source)
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS