CrewAI Framework Multiple Vulnerabilities Summary (RCE/SSRF/File Read)

Vulnerability Summary: CrewAI Multiple Vulnerabilities (VU#221883) Vulnerability Overview This advisory identifies four critical security vulnerabilities within the CrewAI framework, including Remote Code Execution (RCE), arbitrary local file reading, and Server-Side Request Forgery (SSRF). CVE-2026-2275 (RCE): The Code Interpreter Tool falls back to SandboxPython when unable to connect to Docker, allowing code execution via arbitrary C function calls. This can be triggered if is enabled or if the tool is manually added. CVE-2026-2286 (SSRF): A Server-Side Request Forgery vulnerability exists where the RAG search tool fails to properly validate URLs, enabling the retrieval of content from both internal and cloud services. CVE-2026-2287 (RCE): The system fails to correctly verify if Docker is running at runtime. If Docker is unavailable, it falls back to a sandbox configuration that permits RCE. CVE-2026-2285 (File Reading): An arbitrary local file reading vulnerability exists in the JSON loader tool. The lack of path validation during file reading allows access to files on the server. Scope of Impact Attackers can exploit these four vulnerabilities through direct or prompt injection. The attack outcome depends on the agent configuration or host state: Sandbox bypass may be achievable. If the host is using Docker, this may lead to RCE or file reading. If the host is in a misconfigured or insecure mode, it may result in full RCE. Attackers can leverage arbitrary file reading and SSRF to steal credentials or use RCE to further compromise the affected device. Remediation Vendor Planned Actions: Add and related modules to the list. Evaluate configuration changes to be stricter than falling back to sandbox mode. Provide clearer runtime warnings when sandbox mode is active. Improve security-related documentation. Workarounds (Prior to Patch Release): Remove or disable the Code Interpreter Tool wherever possible. Avoid enabling the setting unless absolutely necessary. Limit agent exposure to untrusted inputs or sandbox inputs. Monitor Docker availability and prevent fallback to an insecure sandbox mode.

Goal Reached Thanks to every supporter — we hit 100%!

CrewAI Framework Multiple Vulnerabilities Summary (RCE/SSRF/File Read)