Quick answers
- Is CVE-2026-37007 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-37007 being exploited in the wild.
- How severe is CVE-2026-37007?
- Critical severity, with a CVSS score of 9.8, published 27 August 2026.
- Which products and versions are affected?
- CrewAI crewai-tools up to 1.10.2rc1.
- Is there a fix for CVE-2026-37007?
- A patch was published on 2026-08-27: Fix applied in commit 713fa7d Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-37007 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-37007?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal flaw in the FileWriterTool component that fails to properly sanitize filename arguments. An attacker can inject path traversal sequences (e.g., "../") to escape the intended output directory and write files to arbitrary locations on the filesystem. By writing malicious Python code or scripts to executable locations, an attacker can achieve remote code execution. The vulnerability affects crewai-tools versions up to and including 1.10.2rc1. The fix, implemented in commit 713fa7d, adds proper path validation to prevent traversal attacks.
Affected products
- CrewAI crewai-tools up to 1.10.2rc1
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fix applied in commit 713fa7d