CrewAI — an unpatched ZDI zero-day in load_agent_from_repository (CVE-2026-92206, CVSS 8.8) on top of eight 2026 CVEs the project never posted an advisory for: a CVSS 9.8 FileWriterTool path-traversal RCE, a sandbox that falls back to unsafe Python when Docker is missing, and a blocklist ctypes can walk around

View raw markdownEdit on GitHub ↗

TL;DR

CrewAI (crewAIInc/crewAI, the multi-agent orchestration framework; crewai and crewai-tools on PyPI, both at 1.15.22 as of 2026-09-17) has no published GitHub Security Advisories at all — its advisory tab reads "There aren't any published security advisories" — yet the CVE record shows nine 2026 CVEs, the newest an unpatched zero-day Trend Micro's Zero Day Initiative published on 2026-09-16 after eleven months without a vendor fix. CVE-2026-92206 (ZDI-26-706, CVSS 3.1 8.8): load_agent_from_repository does not restrict a user-supplied argument before using it to import a module, so loading a malicious agent configuration is remote code execution; ZDI's only mitigation is "restrict interaction with the product." Behind it, in the GitHub Advisory Database as CVE-sourced entries with no package metadata: CVE-2026-37007 (CVSS 9.8) — FileWriterTool in crewai-tools ≤ 1.10.2rc1 accepted ../ in the filename and wrote anywhere, fixed by commit 713fa7d ("prevent path traversal in FileWriterTool", PR #4895); CVE-2026-37008 (8.1) — the Python code-interpreter's import blocklist is bypassable because ctypes.CDLL(None) loads libc with no import statement, fixed by commit fb2323b ("Code interpreter sandbox escape", PR #4791), which makes Docker mandatory; CVE-2026-62240 (8.3) — SSRF redirect/DNS-rebinding bypass in validate_url, fixed crewai-tools 1.15.1; CVE-2026-37009 (6.5) — SQL injection in NL2SQLTool; and the March 2026 cluster CVE-2026-2275 (9.6) / CVE-2026-2287 (9.8) — CodeInterpreter falls back to an escapable in-process sandbox when Docker is unavailable or stops running — plus CVE-2026-2285 (7.5, JSON loader arbitrary file read) and CVE-2026-2286 (9.8, RAG search tools SSRF). Only two of nine carry a version range. Run the latest crewai/crewai-tools, never load agent definitions from untrusted repositories, require Docker for code execution, and treat every tool that takes a path or URL from the model as reachable by prompt injection.

What happened

The zero-day (2026-09-16). ZDI advisory ZDI-26-706 (ZDI-CAN-28387; researchers Peter Girnus, Demeng Chen and Brandon Niemczyk, Trend Micro Zero Day Initiative) describes an unsafe reflection bug in CrewAI's load_agent_from_repository: "the process does not properly restrict a user-supplied argument before using it to import a module," which "enables remote code execution when a target loads a malicious agent configuration." CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8, user interaction = the victim loads the configuration). ZDI's timeline: reported to the vendor 2025-10-29, follow-up 2026-02-02, publication-intent notice 2026-04-02, published as a 0-day 2026-09-16. No fixed version is named; the advisory's mitigation is to "restrict interaction with the product." NVD had no record for CVE-2026-92206 at sweep time (the ZDI advisory page is the primary, and ZDI is the CNA). "Load an agent from a repository" is precisely the sharing model the agent ecosystem is converging on — the same shape as Deadbugz (a malicious MCP server distributed by pull request) and the ClawHub/skills marketplace findings: the artifact you fetch is the code path.

The same researchers' MindsDB zero-day, same day. ZDI-26-707 (CVE-2026-92207, 8.8, authenticated code injection in MindsDB's OpenBBtable) was published alongside it on the same timeline shape (reported 2025-11-20, 0-day 2026-09-16) — folded into this repo's MindsDB advisory. Two agent-framework vendors, two reports sitting ten-plus months, two unpatched publications on one day.

The FileWriterTool RCE (CVE-2026-37007, published 2026-08-27, CVSS 9.8). GHSA-v667-mxv8-67r8 (unreviewed, CVE-sourced): "crewai-tools ≤ 1.10.2rc1" — FileWriterTool passed the model-chosen filename argument to the filesystem without normalisation, so ../../ sequences (and absolute paths, and symlink escapes) wrote outside the intended directory; AV:N/PR:N/UI:N. The fix commit 713fa7d ("fix: prevent path traversal in FileWriterTool (#4895)") adds Path.resolve() + is_relative_to() checks and three tests for traversal, absolute-path and symlink escapes. The GHSA entry lists no patched version and no package metadata, so Dependabot will not alert on it; the commit is in the current 1.15.x line (the affected range predates 1.11.0, and PyPI shows 1.15.22 current on 2026-09-16). A file-write tool with a model-chosen path is a write-anywhere primitive the moment a prompt injection reaches the model — .bashrc, authorized_keys, a cron entry, .claude/settings.json.

The code-interpreter sandbox (three CVEs, one lesson). The March cluster — CVE-2026-2275 (CVSS 9.6, "defaults to SandboxPython when Docker is unavailable… arbitrary C function calling") and CVE-2026-2287 (9.8, "does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE") — and the August CVE-2026-37008 (8.1, GHSA-2q68-3cp7-72v9): "CrewAI's Python blocklist approach fails to prevent sandbox escapes because it only blocks imports at runtime… calling ctypes.CDLL(None) loads the C library without relying on any import statements." The advisory's own framing is the point: a within-process sandbox has to account for the entire interpreter, not the import system. The fix commit fb2323b ("Code interpreter sandbox escape (#4791)") enforces Docker as mandatory — execution now raises RuntimeError when Docker is missing unless the user sets unsafe_mode=True. This is the exact root cause of the Pyodide escapes across seven products and the vm2 line: a denylist over language features is not a boundary, and a "safe fallback" that is weaker than the primary is a downgrade attack waiting to happen.

The network-reaching tools. CVE-2026-62240 (GHSA-mr4r-hcgx-8p4h, CVSS 8.3, published 2026-07-14): validate_url resolved DNS and checked a blocklist once, then returned the original URL unmodified, so a redirect chain or DNS rebinding reached internal services and cloud metadata; fixed in crewai-tools 1.15.1 via PR #6331, which validates throughout the request lifecycle. The March CVE-2026-2286 (9.8) is the same class in the RAG search tools ("not properly validating URLs provided at runtime"), and CVE-2026-2285 (7.5) is the JSON loader reading arbitrary server files. CVE-2026-37009 (GHSA-cfvm-24fr-q9xj, 6.5, published 2026-08-27): NL2SQLTool in 1.10.2rc1 passes an unsanitised sql_query to the database — a natural-language-to-SQL tool is designed to execute model-written SQL, so the only real control is the database role it runs as.

Why the vendor silence matters. CrewAI's own advisory tab is empty. Seven of the nine CVEs carry no affected/patched version in any database, four are tagged "unknown versions" by their CNA, and the two fix commits are only findable by reading the GHSA references. A team pinning crewai==1.9.x from a spring tutorial has no signal that anything is wrong. This repo's Check Point "No Tools Required" entry already noted that CrewAI findings were being reported "in aggregate" with no CVE numbers; these are the numbers.

Am I affected?

# Versions — the SSRF fix is the only one with a stated version (crewai-tools 1.15.1)
pip show crewai crewai-tools 2>/dev/null | grep -E '^(Name|Version)'
# Do you load agents/crews from a repository or a user-supplied path?  (the 0-day)
grep -rn 'load_agent_from_repository\|from_repository' --include='*.py' . 2>/dev/null
# Do you use the tools with CVEs?
grep -rn 'FileWriterTool\|CodeInterpreterTool\|NL2SQLTool\|JSONSearchTool\|WebsiteSearchTool\|ScrapeWebsiteTool' --include='*.py' . 2>/dev/null
# Is Docker actually present where the code interpreter runs?  (the fallback CVEs)
docker info >/dev/null 2>&1 && echo docker-ok || echo NO-DOCKER

You are affected by the zero-day if any code path loads an agent definition from a repository or a location an outside party can influence — there is no patched version as of 2026-09-17. You are affected by the rest if you run crewai-tools older than 1.15.1 (SSRF) or any version that predates the two fix commits (roughly, anything from before mid-2026), and in particular if your CodeInterpreter host lacks Docker.

If you are affected

  1. Stop loading agent configurations from repositories you do not control until CrewAI ships a fix for CVE-2026-92206; pin the agents you run to files in your own reviewed source tree.
  2. Upgrade crewai and crewai-tools to the current release (≥ 1.15.1 at minimum for the SSRF fix; latest for the two commit-only fixes), and confirm Docker is present wherever CodeInterpreterTool runs — never set unsafe_mode=True outside a throwaway VM.
  3. If a crew with FileWriterTool ever processed untrusted content on a pre-fix version, audit the host for writes outside the working directory (find / -newer <deploy-marker> -type f 2>/dev/null on the relevant paths, plus ~/.ssh, shell rc files, cron, agent config dirs) and rotate anything a written file could have read. → playbooks/if-your-local-ai-agent-was-exploited.md
  4. If the crew ran on cloud infrastructure with a pre-1.15.1 crewai-tools and any URL-taking tool, assume the metadata endpoint was reachable and rotate the instance role's credentials. → playbooks/rotating-cloud-credentials.md
  5. Run NL2SQLTool as a read-only database role with no FILE/DDL privileges, regardless of version.

Prevention

  • → prevention/agent-sandboxing.md — model-executed code needs an OS-level boundary (container, VM, seccomp); an in-process allow/deny list is a mitigation, not a boundary, and a fallback that is weaker than the primary must fail closed.
  • → prevention/package-vetting-checklist.md — an agent definition fetched from a repository is executable configuration; review it like a dependency.
  • Walk github.com/<org>/<repo>/security/advisories and github.com/advisories?query=<package> — for CrewAI the first is empty and the second holds nine CVEs.

Update 2026-10-20 — crewai-tools SSRF through 1.15.28, CVE-2026-112308, fix PR closed unmerged

VulnCheck published CVE-2026-112308 on 2026-10-19 (reporters SashaMIT and Zachariah Mithani; CVSS 4.0 8.3, 3.1 7.4; CWE-918): SeleniumScrapingTool in crewai-tools never applies the validate_url private-address check the Firecrawl and Scrapfly tools use, so an attacker who steers the tool's input, through prompt injection for example, can point headless Chrome at loopback, RFC 1918 or cloud-metadata addresses and read internal data and cloud credentials. The record's range is "through 1.15.28", which is the newest crewai-tools on PyPI as of 2026-10-20, so every release is affected. The referenced fix, pull request #6870 (opened 2026-08-08), was closed unmerged by the repository's bot on 2026-09-17 because "first-time contributors need an associated open issue before we can review a PR"; the record cites it anyway. No vendor advisory, no entry on the still-empty security tab, no fixed version. Do not give the tool a URL from untrusted input, and run crews that scrape inside an egress-filtered sandbox with no metadata-endpoint access, as the agent sandboxing guide describes.

Update 2026-11-03 — CERT/CC issues CVE-2026-120630 for the urlparse backslash SSRF-guard bypass, fixed in crewai-tools 1.15.17 since 2026-08-20

CERT/CC published CVE-2026-120630 on 2026-11-02 (no CVSS) for the validate_url parser differential badcast.dev reported on 2026-08-02: a backslash in the URL authority passes urlparse and reaches urllib3 as a different host, reachable from ScrapeWebsiteTool. The fix is pull request 6981, merged 2026-08-17, released as crewai-tools and crewai 1.15.17 on 2026-08-20. The record names the product "CrewAI"; the code is in crewai-tools, and the two share version numbers. The database row (GHSA-x35j-64g3-fxg7) is unreviewed with no package range. The full write-up, with Langflow's August record for the same bug class, is in the parser-differential file. Sources: CVE Services — CVE-2026-120630 (fetched 2026-11-03); crewAIInc/crewAI pull request 6981 (fetched 2026-11-03: merged 2026-08-17); PyPI crewai-tools 1.15.17 (queried 2026-11-03: 2026-08-20).

Sources