criticalPrivacy violation UnknownPublish anonymously
CrewAI Critical Vulnerabilities (CVE-2026-2275 et al.)
by Publish anonymously · 2 days agoviews 0en
PII protected
Personal information such as emails, phone numbers, IDs and access tokens are automatically masked before publication.
Four CVEs: sandbox escape via CodeInterpreter Docker fallback, SSRF in RAG search tools, arbitrary local file read in JSON loader. Chained via prompt injection to escape sandbox and execute code on host. Separately, a leaked internal GitHub token (CVSS 9.2) granted full access to CrewAI's private repos. No complete patch available.