Executive brief
CrewAI's CodeInterpreterTool is a component that safely executes Python code within an isolated sandbox environment. The vulnerability allows attackers to escape this sandbox by exploiting Python's object introspection capabilities (such as ctypes.CDLL) to bypass import-time module blocklists and access arbitrary functions and system libraries. This enables remote code execution on the host system when the tool is used to process untrusted code.
Technical details
The vulnerability is a sandbox escape in CrewAI's restricted Python sandbox that relied on blocking imports at the module level. However, this approach is ineffective because Python's complete object graph remains accessible at runtime, independent of import statements. An attacker can call ctypes.CDLL(None) or similar methods to load the C library and execute arbitrary native code without triggering any import-based restrictions. The sandbox fallback was used when Docker was unavailable; the fix removes this insecure fallback and requires Docker for safe execution, failing closed with RuntimeError otherwise. Unsafe execution can still be enabled via unsafe_mode=True flag with explicit user acknowledgment of the security risks.
Affected products
- CrewAI CrewAI before fb2323b
Timeline
- 2026-09-13: disclosed: CVE-2026-37008 published
- 2026-03-15: patched: Fix committed in commit fb2323b