CrewAI — an unpatched ZDI zero-day in load_agent_from_repository (CVE-2026-92206, CVSS 8.8) on top of eight 2026 CVEs the project never posted an advisory for: a CVSS 9.8 FileWriterTool path-traversal RCE, a sandbox that falls back to unsafe Python when Docker is missing, and a blocklist ctypes can walk around

View raw markdownEdit on GitHub ↗

TL;DR

CrewAI (crewAIInc/crewAI, the multi-agent orchestration framework; crewai and crewai-tools on PyPI, both at 1.15.22 as of 2026-09-17) has no published GitHub Security Advisories at all — its advisory tab reads "There aren't any published security advisories" — yet the CVE record shows nine 2026 CVEs, the newest an unpatched zero-day Trend Micro's Zero Day Initiative published on 2026-09-16 after eleven months without a vendor fix. CVE-2026-92206 (ZDI-26-706, CVSS 3.1 8.8): load_agent_from_repository does not restrict a user-supplied argument before using it to import a module, so loading a malicious agent configuration is remote code execution; ZDI's only mitigation is "restrict interaction with the product." Behind it, in the GitHub Advisory Database as CVE-sourced entries with no package metadata: CVE-2026-37007 (CVSS 9.8) — FileWriterTool in crewai-tools ≤ 1.10.2rc1 accepted ../ in the filename and wrote anywhere, fixed by commit 713fa7d ("prevent path traversal in FileWriterTool", PR #4895); CVE-2026-37008 (8.1) — the Python code-interpreter's import blocklist is bypassable because ctypes.CDLL(None) loads libc with no import statement, fixed by commit fb2323b ("Code interpreter sandbox escape", PR #4791), which makes Docker mandatory; CVE-2026-62240 (8.3) — SSRF redirect/DNS-rebinding bypass in validate_url, fixed crewai-tools 1.15.1; CVE-2026-37009 (6.5) — SQL injection in NL2SQLTool; and the March 2026 cluster CVE-2026-2275 (9.6) / CVE-2026-2287 (9.8) — CodeInterpreter falls back to an escapable in-process sandbox when Docker is unavailable or stops running — plus CVE-2026-2285 (7.5, JSON loader arbitrary file read) and CVE-2026-2286 (9.8, RAG search tools SSRF). Only two of nine carry a version range. Run the latest crewai/crewai-tools, never load agent definitions from untrusted repositories, require Docker for code execution, and treat every tool that takes a path or URL from the model as reachable by prompt injection.

What happened

The zero-day (2026-09-16). ZDI advisory ZDI-26-706 (ZDI-CAN-28387; researchers Peter Girnus, Demeng Chen and Brandon Niemczyk, Trend Micro Zero Day Initiative) describes an unsafe reflection bug in CrewAI's load_agent_from_repository: "the process does not properly restrict a user-supplied argument before using it to import a module," which "enables remote code execution when a target loads a malicious agent configuration." CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8, user interaction = the victim loads the configuration). ZDI's timeline: reported to the vendor 2025-10-29, follow-up 2026-02-02, publication-intent notice 2026-04-02, published as a 0-day 2026-09-16. No fixed version is named; the advisory's mitigation is to "restrict interaction with the product." NVD had no record for CVE-2026-92206 at sweep time (the ZDI advisory page is the primary, and ZDI is the CNA). "Load an agent from a repository" is precisely the sharing model the agent ecosystem is converging on — the same shape as Deadbugz (a malicious MCP server distributed by pull request) and the ClawHub/skills marketplace findings: the artifact you fetch is the code path.

The same researchers' MindsDB zero-day, same day. ZDI-26-707 (CVE-2026-92207, 8.8, authenticated code injection in MindsDB's OpenBBtable) was published alongside it on the same timeline shape (reported 2025-11-20, 0-day 2026-09-16) — folded into this repo's MindsDB advisory. Two agent-framework vendors, two reports sitting ten-plus months, two unpatched publications on one day.

The FileWriterTool RCE (CVE-2026-37007, published 2026-08-27, CVSS 9.8). GHSA-v667-mxv8-67r8 (unreviewed, CVE-sourced): "crewai-tools ≤ 1.10.2rc1" — FileWriterTool passed the model-chosen filename argument to the filesystem without normalisation, so ../../ sequences (and absolute paths, and symlink escapes) wrote outside the intended directory; AV:N/PR:N/UI:N. The fix commit 713fa7d ("fix: prevent path traversal in FileWriterTool (#4895)") adds Path.resolve() + is_relative_to() checks and three tests for traversal, absolute-path and symlink escapes. The GHSA entry lists no patched version and no package metadata, so Dependabot will not alert on it; the commit is in the current 1.15.x line (the affected range predates 1.11.0, and PyPI shows 1.15.22 current on 2026-09-16). A file-write tool with a model-chosen path is a write-anywhere primitive the moment a prompt injection reaches the model — .bashrc, authorized_keys, a cron entry, .claude/settings.json.

The code-interpreter sandbox (three CVEs, one lesson). The March cluster — CVE-2026-2275 (CVSS 9.6, "defaults to SandboxPython when Docker is unavailable… arbitrary C function calling") and CVE-2026-2287 (9.8, "does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE") — and the August CVE-2026-37008 (8.1, GHSA-2q68-3cp7-72v9): "CrewAI's Python blocklist approach fails to prevent sandbox escapes because it only blocks imports at runtime… calling ctypes.CDLL(None) loads the C library without relying on any import statements." The advisory's own framing is the point: a within-process sandbox has to account for the entire interpreter, not the import system. The fix commit fb2323b ("Code interpreter sandbox escape (#4791)") enforces Docker as mandatory — execution now raises RuntimeError when Docker is missing unless the user sets unsafe_mode=True. This is the exact root cause of the Pyodide escapes across seven products and the vm2 line: a denylist over language features is not a boundary, and a "safe fallback" that is weaker than the primary is a downgrade attack waiting to happen.

The network-reaching tools. CVE-2026-62240 (GHSA-mr4r-hcgx-8p4h, CVSS 8.3, published 2026-07-14): validate_url resolved DNS and checked a blocklist once, then returned the original URL unmodified, so a redirect chain or DNS rebinding reached internal services and cloud metadata; fixed in crewai-tools 1.15.1 via PR #6331, which validates throughout the request lifecycle. The March CVE-2026-2286 (9.8) is the same class in the RAG search tools ("not properly validating URLs provided at runtime"), and CVE-2026-2285 (7.5) is the JSON loader reading arbitrary server files. CVE-2026-37009 (GHSA-cfvm-24fr-q9xj, 6.5, published 2026-08-27): NL2SQLTool in 1.10.2rc1 passes an unsanitised sql_query to the database — a natural-language-to-SQL tool is designed to execute model-written SQL, so the only real control is the database role it runs as.

Why the vendor silence matters. CrewAI's own advisory tab is empty. Seven of the nine CVEs carry no affected/patched version in any database, four are tagged "unknown versions" by their CNA, and the two fix commits are only findable by reading the GHSA references. A team pinning crewai==1.9.x from a spring tutorial has no signal that anything is wrong. This repo's Check Point "No Tools Required" entry already noted that CrewAI findings were being reported "in aggregate" with no CVE numbers; these are the numbers.

Am I affected?

# Versions — the SSRF fix is the only one with a stated version (crewai-tools 1.15.1)
pip show crewai crewai-tools 2>/dev/null | grep -E '^(Name|Version)'
# Do you load agents/crews from a repository or a user-supplied path?  (the 0-day)
grep -rn 'load_agent_from_repository\|from_repository' --include='*.py' . 2>/dev/null
# Do you use the tools with CVEs?
grep -rn 'FileWriterTool\|CodeInterpreterTool\|NL2SQLTool\|JSONSearchTool\|WebsiteSearchTool\|ScrapeWebsiteTool' --include='*.py' . 2>/dev/null
# Is Docker actually present where the code interpreter runs?  (the fallback CVEs)
docker info >/dev/null 2>&1 && echo docker-ok || echo NO-DOCKER

You are affected by the zero-day if any code path loads an agent definition from a repository or a location an outside party can influence — there is no patched version as of 2026-09-17. You are affected by the rest if you run crewai-tools older than 1.15.1 (SSRF) or any version that predates the two fix commits (roughly, anything from before mid-2026), and in particular if your CodeInterpreter host lacks Docker.

If you are affected

  1. Stop loading agent configurations from repositories you do not control until CrewAI ships a fix for CVE-2026-92206; pin the agents you run to files in your own reviewed source tree.
  2. Upgrade crewai and crewai-tools to the current release (≥ 1.15.1 at minimum for the SSRF fix; latest for the two commit-only fixes), and confirm Docker is present wherever CodeInterpreterTool runs — never set unsafe_mode=True outside a throwaway VM.
  3. If a crew with FileWriterTool ever processed untrusted content on a pre-fix version, audit the host for writes outside the working directory (find / -newer <deploy-marker> -type f 2>/dev/null on the relevant paths, plus ~/.ssh, shell rc files, cron, agent config dirs) and rotate anything a written file could have read. → playbooks/if-your-local-ai-agent-was-exploited.md
  4. If the crew ran on cloud infrastructure with a pre-1.15.1 crewai-tools and any URL-taking tool, assume the metadata endpoint was reachable and rotate the instance role's credentials. → playbooks/rotating-cloud-credentials.md
  5. Run NL2SQLTool as a read-only database role with no FILE/DDL privileges, regardless of version.

Prevention

  • → prevention/agent-sandboxing.md — model-executed code needs an OS-level boundary (container, VM, seccomp); an in-process allow/deny list is a mitigation, not a boundary, and a fallback that is weaker than the primary must fail closed.
  • → prevention/package-vetting-checklist.md — an agent definition fetched from a repository is executable configuration; review it like a dependency.
  • Walk github.com/<org>/<repo>/security/advisories and github.com/advisories?query=<package> — for CrewAI the first is empty and the second holds nine CVEs.

Sources