---
id: 2026-09-crewai-zdi-zero-day-agent-loading-cve-batch
title: "CrewAI — an unpatched ZDI zero-day in load_agent_from_repository (CVE-2026-92206, CVSS 8.8) on top of eight 2026 CVEs the project never posted an advisory for: a CVSS 9.8 FileWriterTool path-traversal RCE, a sandbox that falls back to unsafe Python when Docker is missing, and a blocklist ctypes can walk around"
date_disclosed: 2026-09-16
last_updated: 2026-09-17
severity: critical
status: active
ecosystems: [pypi, python, ai-agent-frameworks]
tools_affected: [crewai, crewai-tools, "any app that loads CrewAI agent definitions or crews from a repository or a user-supplied config", "CrewAI CodeInterpreterTool / FileWriterTool / NL2SQLTool / RAG search tools"]
tags: [cve, zero-day, unsafe-reflection, rce, path-traversal, sandbox-escape, ssrf, sql-injection, agent-frameworks, vendor-silence]
---

## TL;DR
**CrewAI** (crewAIInc/crewAI, the multi-agent orchestration framework; `crewai` and `crewai-tools` on PyPI, both at 1.15.22 as of 2026-09-17) has **no published GitHub Security Advisories at all** — its advisory tab reads "There aren't any published security advisories" — yet the CVE record shows **nine 2026 CVEs**, the newest an **unpatched zero-day** Trend Micro's Zero Day Initiative published on **2026-09-16** after eleven months without a vendor fix. **CVE-2026-92206** (ZDI-26-706, CVSS 3.1 **8.8**): `load_agent_from_repository` does not restrict a user-supplied argument before using it to import a module, so loading a malicious agent configuration is remote code execution; ZDI's only mitigation is "restrict interaction with the product." Behind it, in the GitHub Advisory Database as CVE-sourced entries with no package metadata: **CVE-2026-37007** (CVSS **9.8**) — `FileWriterTool` in `crewai-tools ≤ 1.10.2rc1` accepted `../` in the filename and wrote anywhere, fixed by commit `713fa7d` ("prevent path traversal in FileWriterTool", PR #4895); **CVE-2026-37008** (8.1) — the Python code-interpreter's import blocklist is bypassable because `ctypes.CDLL(None)` loads libc with no `import` statement, fixed by commit `fb2323b` ("Code interpreter sandbox escape", PR #4791), which makes Docker mandatory; **CVE-2026-62240** (8.3) — SSRF redirect/DNS-rebinding bypass in `validate_url`, fixed **crewai-tools 1.15.1**; **CVE-2026-37009** (6.5) — SQL injection in `NL2SQLTool`; and the March 2026 cluster **CVE-2026-2275** (9.6) / **CVE-2026-2287** (9.8) — CodeInterpreter falls back to an escapable in-process sandbox when Docker is unavailable or stops running — plus **CVE-2026-2285** (7.5, JSON loader arbitrary file read) and **CVE-2026-2286** (9.8, RAG search tools SSRF). Only two of nine carry a version range. Run the latest `crewai`/`crewai-tools`, never load agent definitions from untrusted repositories, require Docker for code execution, and treat every tool that takes a path or URL from the model as reachable by prompt injection.

## What happened

**The zero-day (2026-09-16).** ZDI advisory **ZDI-26-706** (ZDI-CAN-28387; researchers Peter Girnus, Demeng Chen and Brandon Niemczyk, Trend Micro Zero Day Initiative) describes an **unsafe reflection** bug in CrewAI's `load_agent_from_repository`: "the process does not properly restrict a user-supplied argument before using it to import a module," which "enables remote code execution when a target loads a malicious agent configuration." CVSS 3.1 vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` (**8.8**, user interaction = the victim loads the configuration). ZDI's timeline: **reported to the vendor 2025-10-29**, follow-up 2026-02-02, publication-intent notice 2026-04-02, **published as a 0-day 2026-09-16**. No fixed version is named; the advisory's mitigation is to "restrict interaction with the product." NVD had no record for CVE-2026-92206 at sweep time (the ZDI advisory page is the primary, and ZDI is the CNA). "Load an agent from a repository" is precisely the sharing model the agent ecosystem is converging on — the same shape as [Deadbugz](2026-09-deadbugz-mcp-supply-chain-campaign.md) (a malicious MCP server distributed by pull request) and the ClawHub/skills marketplace findings: the artifact you fetch *is* the code path.

**The same researchers' MindsDB zero-day, same day.** ZDI-26-707 (**CVE-2026-92207**, 8.8, authenticated code injection in MindsDB's `OpenBBtable`) was published alongside it on the same timeline shape (reported 2025-11-20, 0-day 2026-09-16) — folded into this repo's [MindsDB advisory](2026-08-mindsdb-minds-platform-unauthenticated-rce.md). Two agent-framework vendors, two reports sitting ten-plus months, two unpatched publications on one day.

**The FileWriterTool RCE (CVE-2026-37007, published 2026-08-27, CVSS 9.8).** GHSA-v667-mxv8-67r8 (unreviewed, CVE-sourced): "crewai-tools ≤ 1.10.2rc1" — `FileWriterTool` passed the model-chosen `filename` argument to the filesystem without normalisation, so `../../` sequences (and absolute paths, and symlink escapes) wrote outside the intended directory; `AV:N/PR:N/UI:N`. The fix commit `713fa7d` ("fix: prevent path traversal in FileWriterTool (#4895)") adds `Path.resolve()` + `is_relative_to()` checks and three tests for traversal, absolute-path and symlink escapes. The GHSA entry lists **no patched version** and no package metadata, so Dependabot will not alert on it; the commit is in the current 1.15.x line (the affected range predates 1.11.0, and PyPI shows 1.15.22 current on 2026-09-16). A file-write tool with a model-chosen path is a write-anywhere primitive the moment a prompt injection reaches the model — `.bashrc`, `authorized_keys`, a cron entry, `.claude/settings.json`.

**The code-interpreter sandbox (three CVEs, one lesson).** The March cluster — **CVE-2026-2275** (CVSS 9.6, "defaults to SandboxPython when Docker is unavailable… arbitrary C function calling") and **CVE-2026-2287** (9.8, "does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE") — and the August **CVE-2026-37008** (8.1, GHSA-2q68-3cp7-72v9): "CrewAI's Python blocklist approach fails to prevent sandbox escapes because it only blocks imports at runtime… calling `ctypes.CDLL(None)` loads the C library without relying on any import statements." The advisory's own framing is the point: a within-process sandbox has to account for the *entire* interpreter, not the import system. The fix commit `fb2323b` ("Code interpreter sandbox escape (#4791)") enforces Docker as mandatory — execution now raises `RuntimeError` when Docker is missing unless the user sets `unsafe_mode=True`. This is the exact root cause of the [Pyodide escapes across seven products](2026-08-pyodide-sandbox-escape-cluster.md) and the [vm2 line](2026-08-vm2-isolated-vm-sandbox-escapes.md): a denylist over language features is not a boundary, and a "safe fallback" that is weaker than the primary is a downgrade attack waiting to happen.

**The network-reaching tools.** **CVE-2026-62240** (GHSA-mr4r-hcgx-8p4h, CVSS 8.3, published 2026-07-14): `validate_url` resolved DNS and checked a blocklist once, then returned the *original* URL unmodified, so a redirect chain or DNS rebinding reached internal services and cloud metadata; fixed in **crewai-tools 1.15.1** via PR #6331, which validates throughout the request lifecycle. The March **CVE-2026-2286** (9.8) is the same class in the RAG search tools ("not properly validating URLs provided at runtime"), and **CVE-2026-2285** (7.5) is the JSON loader reading arbitrary server files. **CVE-2026-37009** (GHSA-cfvm-24fr-q9xj, 6.5, published 2026-08-27): `NL2SQLTool` in 1.10.2rc1 passes an unsanitised `sql_query` to the database — a natural-language-to-SQL tool is *designed* to execute model-written SQL, so the only real control is the database role it runs as.

**Why the vendor silence matters.** CrewAI's own advisory tab is empty. Seven of the nine CVEs carry **no affected/patched version** in any database, four are tagged "unknown versions" by their CNA, and the two fix commits are only findable by reading the GHSA references. A team pinning `crewai==1.9.x` from a spring tutorial has no signal that anything is wrong. This repo's [Check Point "No Tools Required" entry](2026-08-checkpoint-agent-framework-post-injection-cluster.md) already noted that CrewAI findings were being reported "in aggregate" with no CVE numbers; these are the numbers.

## Am I affected?

```bash
# Versions — the SSRF fix is the only one with a stated version (crewai-tools 1.15.1)
pip show crewai crewai-tools 2>/dev/null | grep -E '^(Name|Version)'
# Do you load agents/crews from a repository or a user-supplied path?  (the 0-day)
grep -rn 'load_agent_from_repository\|from_repository' --include='*.py' . 2>/dev/null
# Do you use the tools with CVEs?
grep -rn 'FileWriterTool\|CodeInterpreterTool\|NL2SQLTool\|JSONSearchTool\|WebsiteSearchTool\|ScrapeWebsiteTool' --include='*.py' . 2>/dev/null
# Is Docker actually present where the code interpreter runs?  (the fallback CVEs)
docker info >/dev/null 2>&1 && echo docker-ok || echo NO-DOCKER
```

You are affected by the zero-day if any code path loads an agent definition from a repository or a location an outside party can influence — there is no patched version as of 2026-09-17. You are affected by the rest if you run `crewai-tools` older than 1.15.1 (SSRF) or any version that predates the two fix commits (roughly, anything from before mid-2026), and in particular if your CodeInterpreter host lacks Docker.

## If you are affected

1. **Stop loading agent configurations from repositories you do not control** until CrewAI ships a fix for CVE-2026-92206; pin the agents you run to files in your own reviewed source tree.
2. Upgrade `crewai` and `crewai-tools` to the current release (≥ 1.15.1 at minimum for the SSRF fix; latest for the two commit-only fixes), and confirm Docker is present wherever `CodeInterpreterTool` runs — never set `unsafe_mode=True` outside a throwaway VM.
3. If a crew with `FileWriterTool` ever processed untrusted content on a pre-fix version, audit the host for writes outside the working directory (`find / -newer <deploy-marker> -type f 2>/dev/null` on the relevant paths, plus `~/.ssh`, shell rc files, cron, agent config dirs) and rotate anything a written file could have read. → [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md)
4. If the crew ran on cloud infrastructure with a pre-1.15.1 `crewai-tools` and any URL-taking tool, assume the metadata endpoint was reachable and rotate the instance role's credentials. → [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md)
5. Run `NL2SQLTool` as a read-only database role with no `FILE`/DDL privileges, regardless of version.

## Prevention

- → [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md) — model-executed code needs an OS-level boundary (container, VM, seccomp); an in-process allow/deny list is a mitigation, not a boundary, and a fallback that is weaker than the primary must fail closed.
- → [prevention/package-vetting-checklist.md](../prevention/package-vetting-checklist.md) — an agent definition fetched from a repository is executable configuration; review it like a dependency.
- Walk `github.com/<org>/<repo>/security/advisories` *and* `github.com/advisories?query=<package>` — for CrewAI the first is empty and the second holds nine CVEs.

## Sources

- [Zero Day Initiative — ZDI-26-706: (0Day) crewAI Framework load_agent_from_repository Unsafe Reflection Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-706/) — fetched 2026-09-17; primary: CVE-2026-92206, CVSS 8.8 vector, mechanism, researcher credits, 2025-10-29 report → 2026-09-16 0-day timeline, "restrict interaction with the product" mitigation.
- [Zero Day Initiative — ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-707/) — fetched 2026-09-17; the sibling same-day 0-day (CVE-2026-92207) referenced above.
- [GitHub Advisory Database — GHSA-v667-mxv8-67r8 (CVE-2026-37007)](https://github.com/advisories/GHSA-v667-mxv8-67r8) — fetched 2026-09-17; CVSS 9.8, `crewai-tools ≤ 1.10.2rc1`, FileWriterTool path traversal, reference to fix commit 713fa7d, published 2026-08-27, no patched version listed.
- [crewAIInc/crewAI — commit 713fa7d "fix: prevent path traversal in FileWriterTool (#4895)"](https://github.com/crewAIInc/crewAI/commit/713fa7d) — fetched 2026-09-17; `Path.resolve()` + `is_relative_to()` guard and the three new escape tests.
- [GitHub Advisory Database — GHSA-2q68-3cp7-72v9 (CVE-2026-37008)](https://github.com/advisories/GHSA-2q68-3cp7-72v9) — fetched 2026-09-17; CVSS 8.1, the `ctypes.CDLL(None)` blocklist bypass, "before commit fb2323b," published 2026-09-13, explicitly distinct from CVE-2026-2275.
- [crewAIInc/crewAI — commit fb2323b "Code interpreter sandbox escape (#4791)"](https://github.com/crewAIInc/crewAI/commit/fb2323b) — fetched 2026-09-17; Docker made mandatory, `RuntimeError` without it unless `unsafe_mode=True`.
- [GitHub Advisory Database — GHSA-mr4r-hcgx-8p4h (CVE-2026-62240)](https://github.com/advisories/GHSA-mr4r-hcgx-8p4h) — fetched 2026-09-17; CVSS 8.3, `validate_url` redirect/DNS-rebinding bypass, fixed crewai-tools 1.15.1, PR #6331.
- [GitHub Advisory Database — GHSA-cfvm-24fr-q9xj (CVE-2026-37009)](https://github.com/advisories/GHSA-cfvm-24fr-q9xj) — fetched 2026-09-17; CVSS 6.5, NL2SQLTool SQL injection in 1.10.2rc1, no package metadata.
- [GitHub Advisory Database — GHSA-5w94-5wxp-rc42 (CVE-2026-2275)](https://github.com/advisories/GHSA-5w94-5wxp-rc42), [GHSA-mgj5-c563-6f76 (CVE-2026-2287)](https://github.com/advisories/GHSA-mgj5-c563-6f76), [GHSA-85jf-9mcx-32r5 (CVE-2026-2285)](https://github.com/advisories/GHSA-85jf-9mcx-32r5), [GHSA-pgf5-gw7r-wxg7 (CVE-2026-2286)](https://github.com/advisories/GHSA-pgf5-gw7r-wxg7) — all fetched 2026-09-17; the 2026-03-30 cluster (Docker-fallback RCE ×2, JSON loader file read, RAG search SSRF), all "affected/patched versions unknown."
- [GitHub Advisory Database — search "crewai", sorted by published date](https://github.com/advisories?query=crewai+sort%3Apublished-desc) — fetched 2026-09-17; the nine-CVE listing.
- [crewAIInc/crewAI — security advisories tab](https://github.com/crewAIInc/crewAI/security/advisories) — fetched 2026-09-17: "There aren't any published security advisories."
- PyPI release listing for `crewai` and `crewai-tools` via `pip index versions` and the PyPI JSON API — fetched 2026-09-17; both at 1.15.22 (released 2026-09-16), 1.15.1 released earlier in the 1.15 line.