65 matches found
Improper Protection of Alternate Path
Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
EUVD-2026-77111
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
PT-2026-90969
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008: Improper Protection of Alternate Path
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...
crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
PYSEC-2026-3819 crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
CVE-2026-37009: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
EUVD-2026-67268
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
The crewai-tools library, specifically in version v1.10.2rc1 , contains a SQL injection vulnerability within the NL2SQLTool component. The root cause is an unsanitized sql_query argument , which allows a remote attacker to execute arbitrary SQL commands. No specific remediation, exploit links, or...