210 matches found
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008: Improper Protection of Alternate Path
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...
EUVD-2026-77111
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
adaptiq (0.12.9), agentchaos-sdk (0.1.0) +23 more potentially affected by CVE-2026-37008 via crewai-tools (>=0.45.0, <=1.6.1)
crewai-tools PYPI version =0.45.0, =0.1.0, =0.0.6, =0.1.7, =0.2.6, =0.1.0, =0.5.42, =0.1.0, =0.74.0, =0.86.0 - crewai-ldn 0.1.0 - faq-rai-sdk 0.1.4 and more Source cves: CVE-2026-37008 Source advisory: MEND:CVE-2026-37008...
PT-2026-90969
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-84311 via pypdf (4.0.2)
pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-391...
chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-84309 via pypdf (4.0.2)
pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-84309 Source advisory: OSV:PYSEC-2026-391...
PYSEC-2026-3819 crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
cognee-integration-crewai (0.1.0) potentially affected by CVE-2026-58473 via cognee (0.3.4)
cognee PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-integration-crewai 0.1.0 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...
paypal-agent-toolkit (>=1.2.0, <=1.11.0) potentially affected by CVE-2026-62240 via crewai-tools (0.13.2)
crewai-tools PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - paypal-agent-toolkit =1.2.0, =1.11.0 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...
hdw-tools (>=0.0.2, <=0.0.5), llm-foundation (>=0.0.19, <=0.0.23) potentially affected by CVE-2026-62240 via crewai-tools (0.13.4)
crewai-tools PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - hdw-tools =0.0.2, =0.0.19, =0.0.23 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...
lpw (0.2.5.0) potentially affected by CVE-2026-62240 via crewai-tools (0.14.0)
crewai-tools PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - lpw 0.2.5.0 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...
langflow-base (0.1.1), langflow-base-nightly (>=0.1.0.dev7, <=0.1.1.dev6) +1 more potentially affected by CVE-2026-62240 via crewai-tools (0.17.0)
crewai-tools PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - langflow-base 0.1.1 - langflow-base-nightly =0.1.0.dev7, =0.1.1.dev6 - langinfra-base 0.1.1 Source cves: CVE-2026-62240 Source advisory...
graphtomation (>=0.0.3, <=0.0.5) potentially affected by CVE-2026-62240 via crewai-tools (0.25.8)
crewai-tools PYPI version 0.25.8 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - graphtomation =0.0.3, =0.0.5 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...
faq-rai-sdk (0.1.4), maq-rai-sdk (>=0.1.2, <=0.2.0) potentially affected by CVE-2026-62240 via crewai-tools (0.45.0)
crewai-tools PYPI version 0.45.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - faq-rai-sdk 0.1.4 - maq-rai-sdk =0.1.2, =0.2.0 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...