Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-37008

Quick assessment

Affected
CrewAI CrewAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CrewAI是CrewAI组织开源的一个支持多智能体协作完成复杂任务的人工智能代理框架。 CrewAI fb2323b之前版本存在权限许可和访问控制问题漏洞，该漏洞源于Python黑名单机制抽象层级不当，仅在导入时拦截模块名，无法覆盖Python的完整对象图，导致进程内沙箱可被绕过。

CVSS 8.1 · High EPSS 0.13% · P3

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services

Affected Version Matrix 1

VendorProduct Version RangeStatus
CrewAI CrewAI < fb2323b3deb3ec62b3965526857e77a2264e4cd0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-37008

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对候选路径的不恰当保护
Source: CVE Program / CVE List V5
Vulnerability Title
CrewAI 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CrewAI是CrewAI组织开源的一个支持多智能体协作完成复杂任务的人工智能代理框架。 CrewAI fb2323b之前版本存在权限许可和访问控制问题漏洞，该漏洞源于Python黑名单机制抽象层级不当，仅在导入时拦截模块名，无法覆盖Python的完整对象图，导致进程内沙箱可被绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
CrewAI CrewAI 0 ~ fb2323b3deb3ec62b3965526857e77a2264e4cd0 -

II. Public POCs for CVE-2026-37008

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-37008

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-37008 (1)

IV. Related Vulnerabilities

Same product: CrewAI
Same vendor: CrewAI
Same weakness: CWE-424

V. Comments for CVE-2026-37008

No comments yet

Leave a comment