people · May 22, 2026

SecurityWeek Details CrewAI Vulnerabilities Allowing Remote Code Execution via Prompt Injection

SecurityWeek reported on CrewAI's four vulnerabilities discovered by Yarden Porat of Cyata, which enable attackers to chain prompt injections to escape the sandbox and execute arbitrary code or read files. CVE-2026-2275 arises when the Code Interpreter tool defaults to SandboxPython without Docker access, permitting arbitrary C function calls for RCE. CVE-2026-2286 is an SSRF flaw in RAG search tools lacking URL validation at runtime. CVE-2026-2287 occurs because CrewAI does not properly check Docker runtime and falls back to an insecure sandbox. CVE-2026-2285 allows arbitrary local file reads in the JSON loader due to missing path validation. Maintainers are developing mitigations including configuration changes and documentation updates, with no full patch confirmed at the time of the March 31, 2026 article update referenced in recent crawls. The report recommends restricting the Code Interpreter tool and sanitizing inputs until fixes are deployed.