SQL Injection Vulnerability in NL2SQLTool by Crewai Inc.
CVE-2026-37009

6.5MEDIUM

Key Information:

Vendor

Crewai Inc.

Status
NL2SQLTool
Vendor
CVE Published:
27 August 2026

What is CVE-2026-37009?

NL2SQLTool in crewai-tools v1.10.2rc1 is susceptible to a SQL injection vulnerability that allows remote attackers to conduct arbitrary SQL command execution through an unsanitized sql_query parameter. This flaw can potentially compromise the integrity and confidentiality of the database, making it critical for users to apply security measures to mitigate risks.

References

http://crewaiinc.com
https://yerangamage.com/cves/detail/?slug=crewai-nl2sql-i...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.