45 matches found
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
EUVD-2026-77111
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
PT-2026-90969
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37007
CVE-2026-37007 affects the FileWriterTool component in crewai-tools versions
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
A SQL injection vulnerability exists in the NL2SQLTool component of crewai-tools v1.10.2rc1 . The root cause is an unsanitized sql_query argument , which allows a remote attacker to execute arbitrary SQL commands with no privileges required and low attack complexity (CVSS 3.1: 6.5 MEDIUM ). CISA ...
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
GHSA-MR4R-HCGX-8P4H crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-62240
CVE-2026-62240 overview : CrewAI before 1.15.1 is affected by a server-side request forgery in the validate_url function, which performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. An attacker can bypass the security filter by providing URLs that redi...
CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
