Sandbox Escape Vulnerability in CrewAI by CrewAIInc

CVE-2026-37008

What is CVE-2026-37008?

CrewAI prior to commit fb2323b utilizes a flawed Python blocklist approach, which does not adequately address the intricacies of Python's complete object graph. This design oversight allows for exploitation, as it fails to restrict access to system libraries through methods like ctypes.CDLL(None), which can load C libraries without relying solely on import statements. As a result, the within-process sandbox is compromised, highlighting the need for more robust runtime security measures beyond basic import system controls.

References