CrewAI CVE-2026-92206

Exploitation requires that the victim actively load a malicious or tampered agent configuration from a repository through the load_agent_from_repository function; the function fails to restrict the user-supplied argument used to import a module (CWE-470). The primary limiting factor is the required user interaction (CVSS UI:R): the attack cannot succeed unless a user is induced to load the attacker-controlled configuration, making this dependent on social engineering, a compromised/shared repository, or a trusted-config supply-chain vector. No authentication to the target is required (PR:N), and code executes with the privileges of the CrewAI service account, so impact scales with how the service is run.

This is a credible, high-priority RCE but one gated by a meaningful precondition. The CVSS 3.0 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network vector, low complexity, no privileges, and full compromise of confidentiality, integrity, and availability - but the UI:R metric is doing heavy lifting: the victim must be convinced to load a malicious agent configuration from an attacker-controlled repository, making this a social-engineering / supply-chain-style attack rather than a drive-by remote exploit. The underlying weakness (CWE-470, unsafe reflection in load_agent_from_repository importing a user-supplied module name) is a well-understood and reliable code-execution primitive, so once a victim loads the malicious config, exploitation is deterministic rather than probabilistic. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation at this time - consistent with a freshly disclosed ZDI advisory. The signals are internally consistent (no CVSS-vs-description conflict), but note the AV:N rating depends on treating remote repository retrieval as the network vector; the actual trigger is a local user action loading the config, which tempers real-world risk below what the raw 8.8 suggests.

An attacker publishes or tampers with an agent configuration in a repository that a CrewAI user is likely to load (e.g., a shared or community agent definition). When the victim loads that configuration via load_agent_from_repository, the unsafe reflection imports an attacker-specified module, executing arbitrary code in the context of the service account. No public exploit code was identified at time of analysis, but the CWE-470 pattern makes reliable exploitation straightforward once the victim loads the crafted config.