38 matches found
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37007
CVE-2026-37007 affects the FileWriterTool component in crewai-tools versions
CVE-2026-37009
A SQL injection vulnerability exists in the NL2SQLTool component of crewai-tools v1.10.2rc1 . The root cause is an unsanitized sql_query argument , which allows a remote attacker to execute arbitrary SQL commands with no privileges required and low attack complexity (CVSS 3.1: 6.5 MEDIUM ). CISA ...
CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...
CVE-2026-37009
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...
crewai-tools SSRF redirect bypass exposes internal services
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-62240
CVE-2026-62240 overview : CrewAI before 1.15.1 is affected by a server-side request forgery in the validate_url function, which performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. An attacker can bypass the security filter by providing URLs that redi...
CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...
CVE-2026-2287
CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation...
EUVD-2026-17117
The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling...
EUVD-2026-17119
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server...
EUVD-2026-17123
CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation...
Server-side Request Forgery (SSRF)
Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...
Server-side Request Forgery (SSRF)
Overview crewai is a Cutting-edge framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks. Affected versions of this package are vulnerable to Server-side Request Forgery SS...
Exposed Dangerous Method or Function
Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the CodeInterpreter tool that fallbacks to SandboxPython when Docker is unreachable. An attacker can execute arbitrary code by invoking...