Crewai

6 CVEs across 1 Crewai products. Browse Crewai vulnerabilities, severities, and proof-of-concept exploits.

Crewai products with known CVEs

ProductCVEs
Crewai6
Crewai CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-37008High8.12026-09-13CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-…
CVE-2026-62240High7.42026-07-13CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist chec…
CVE-2026-2287Critical9.82026-03-30CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation.
CVE-2026-2286Critical9.82026-03-30CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search to…
CVE-2026-2285High7.52026-03-30CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the ser…
CVE-2026-2275Critical9.62026-03-30The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling.