Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-37008

CrewAI · Vulnerability

CVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-37008

Published

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-37008

Published

CrewAI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "CrewAI",
                    "repo": "https://github.com/crewAIInc/crewAI",
                    "vendor": "CrewAI",
                    "versions": [
                        {
                            "lessThan": "fb2323b3deb3ec62b3965526857e77a2264e4cd0",
                            "status": "affected",
                            "version": "0",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON