Four CrewAI CVEs Enable Prompt Injection to Full RCE via Sandbox Escape and SSRF Chain

SecurityWeek·high signalXBlueskyLinkedInCopy link

Security researcher Yarden Porat of Cyata disclosed four critical vulnerabilities in CrewAI: CVE-2026-2275 (Code Interpreter sandbox escape via vulnerable SandboxPython fallback when Docker unavailable), CVE-2026-2287 (RCE from Docker runtime verification failure), CVE-2026-2286 (SSRF via unvalidated RAG search tool URLs), and CVE-2026-2285 (arbitrary file read from unvalidated JSON loader paths). These can be chained through prompt injection — an attacker interacting with a CrewAI agent with Code Interpreter enabled can achieve sandbox bypass and RCE/file read. CERT/CC published advisory VU#221883; no official patch exists yet, with maintainers developing mitigations including fail-closed configurations.