CVE-2026-37008

CrewAI's in-process Python sandbox for agent-executed code uses a blocklist that only intercepts module imports, an approach that operates at the wrong level of abstraction and can be bypassed without any import statement. For example, crafted code can call ctypes.CDLL(None) to obtain a handle to the C runtime library and invoke native functions, because Python's complete object graph (builtins, loaded modules, the interpreter runtime itself) remains reachable regardless of import-time blocking. An attacker who can influence a task or inject content that the agent acts on — e.g., a malicious prompt, document, or tool output — can escape the intended sandbox and achieve arbitrary code execution with the full privileges of the CrewAI process, resulting in high impact to confidentiality and integrity (CVSS 3.1: 8.1). All CrewAI code prior to fix commit fb2323b is affected when using the built-in local code-execution mode rather than Docker isolation; this is a distinct flaw from CVE-2026-2275. There is no known public PoC and no evidence of in-the-wild exploitation, and it is not listed in the CISA KEV catalog.

What to do: Upgrade to a CrewAI build that includes fix commit fb2323b or later as soon as a patched release is published. In the interim, disable local/unsafe code-execution mode and run all agent-generated code in an isolated Docker container (e.g., CODE_EXECUTION_MODE=docker) so escaped payloads cannot reach the host runtime. Review agent execution logs for indicators of native-library access such as ctypes/CDLL usage, and treat any host that executed untrusted task content in local mode as potentially compromised.