ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
ZDI discloses unpatched unsafe reflection RCE vulnerability CVE-2026-92206 (CVSS 8.8) in the CrewAI agent framework.
Zero Day Initiative published ZDI-26-706, an unsafe reflection remote code execution vulnerability in the CrewAI framework, tracked as CVE-2026-92206 with a CVSS score of 8.8. Exploitation requires user interaction: the target must load a malicious agent configuration from the repository. As a 0day advisory, no patch is indicated at publication.
- Unsafe reflection flaw allows remote code execution in CrewAI
- CVE-2026-92206 rated CVSS 8.8
- Exploitation requires loading a malicious agent configuration
- Reported as a 0day via Zero Day Initiative
- CVEs
- CVE-2026-92206
- Vendors
- CrewAIZero Day Initiative
- Products
- CrewAI
- Organizations
- Zero Day InitiativeCrewAI
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92206 | Unsafe reflection RCE in CrewAI agent loading | 8.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.