CVE-2026-37007

FileWriterTool in crewai-tools (versions

CVE-2026-37009

A SQL injection vulnerability exists in NL2SQLTool within crewai-tools v1.10.2rc1 . A remote attacker can execute arbitrary SQL commands by supplying an unsanitized sql_query argument to the tool. No specific remediation or patched version is provided in the available documents, and no exploitati...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...

Exposed Dangerous Method or Function

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the CodeInterpreter tool that fallbacks to SandboxPython when Docker is unreachable. An attacker can execute arbitrary code by invoking...