CVE-2026-37008

8.1 Élevée

Publiée le 13/09/2026 à 23:17 · Modifiée le 22/09/2026 à 22:00 · Analyse NVD reportée · Source : cve@mitre.org

Description

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

Traduire en français

Produits concernés

CrewAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	cve@mitre.org	`CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-424

Références

https://docs.python.org/3/library/ctypes.html
https://github.com/crewAIInc/crewAI/commit/fb2323b3deb3ec62b3965526857e77a2264e4cd0
https://yerangamage.com/cves/detail/?slug=crewai-sandbox-escape
https://yerangamage.com/cves/detail/?slug=crewai-sandbox-escape

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories