CVE-2026-37007

A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...

CVE-2026-37009

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...

CVE-2026-37007

A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...

CVE-2026-37009

A SQL injection vulnerability exists in the NL2SQLTool component of crewai-tools v1.10.2rc1 . The root cause is an unsanitized sql_query argument , which allows a remote attacker to execute arbitrary SQL commands with no privileges required and low attack complexity (CVSS 3.1: 6.5 MEDIUM ). CISA ...

CVE-2026-37007

CVE-2026-37007 affects the FileWriterTool component in crewai-tools versions

CVE-2026-37007

A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...

CVE-2026-37009

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...

Exposed Dangerous Method or Function

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the CodeInterpreter tool that fallbacks to SandboxPython when Docker is unreachable. An attacker can execute arbitrary code by invoking...