Crewai CVE-2026-2285

Remote unauthenticated attacker can exploit CrewAI's JSON loader tool when it is exposed to untrusted input. The vulnerability requires the application to process attacker-controlled file paths without validation. No victim interaction needed if the JSON loader accepts direct input from network requests.

While no CVSS score or vector data is available for formal risk quantification, the vulnerability presents moderate-to-high real-world risk based on attack simplicity and impact. The attack vector is network-based (via CrewAI application endpoints that accept file paths), attack complexity is low (no special conditions or authentication required based on the description), and privileges required are minimal or none. The impact is confidentiality loss through unauthorized file disclosure. The absence of CVE scoring data suggests this may be a recently disclosed or emerging issue. Without EPSS or KEV data, assessment relies on the straightforward nature of path traversal exploitation and the sensitivity of files typically accessible on a server (configuration files, credentials, source code). This is a real priority for any CrewAI deployment exposed to untrusted network access.

An attacker with network access to a CrewAI application instance sends a crafted request to the JSON loader endpoint with a path parameter like '../../etc/passwd' or '/etc/shadow', causing the server to read and return the contents of system files. The attacker repeats this with other sensitive paths (e.g., database configuration files, API keys stored in config files) to extract credentials and system information, potentially enabling further compromise. No public exploit code has been identified, but the vulnerability is trivial to exploit via standard HTTP requests once the vulnerable endpoint is identified.