EUVD-2026-77111
GHSA-2q68-3cp7-72v9
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Network vector because agent API is typically remote; AC:H for required Docker absence; PR:L because agent access generally requires at minimum API authentication; S:C for sandbox-to-host scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
AnalysisAI
Sandbox escape in CrewAI's CodeInterpreterTool allows untrusted Python code to break out of the in-process restricted execution environment and execute arbitrary commands on the host system. Pre-fix versions implemented import-time module name blocking as the sole security boundary, which is bypassable because Python's complete object graph remains accessible - for example, ctypes.CDLL(None) loads the C standard library via the dynamic linker without invoking any import machinery, and __class__.__mro__ traversal can recover the original __import__ built-in. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: first, the target deployment must use CodeInterpreterTool without Docker available, which in pre-fix versions triggered the now-removed restricted Python sandbox fallback - post-fix deployments raise a RuntimeError and refuse execution entirely in this scenario; second, the attacker must be able to influence the Python code submitted to the sandbox, either by having direct access to the code execution API or by successfully injecting a payload into the agent's prompt pipeline (prompt injection). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L scores 8.1 and captures the scope-change (sandbox to host) and high integrity/confidentiality impacts well, but AV:L is a partial mismatch: in practice the CrewAI agent is typically accessed over a network API, and the attacker's influence over executed code arrives through prompt injection or the agent's API surface rather than local login. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix is available via commit fb2323b3deb3ec62b3965526857e77a2264e4cd0 (https://github.com/crewAIInc/crewAI/commit/fb2323b3deb3ec62b3965526857e77a2264e4cd0); a tagged release version incorporating this commit has not been independently confirmed from the available data, so users should verify the installed crewai-tools version includes this commit or upgrade to the latest available release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using crewai-tools CodeInterpreterTool and immediately move production workloads to Docker-containerized deployments or disable the tool entirely; verify that non-containerized instances are removed from service. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-424 – Improper Protection of Alternate Path
View allShare
External POC / Exploit Code
Leaving vuln.today