CVE-2026-37008CWE-424

CVE-2026-37008

High · published September 14, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Weakness
CWE-424 · Improper Protection of Alternate Path
Published
2026-09-14T01:17Z
References (4)
https://docs.python.org/3/library/ctypes.html · [email protected]https://github.com/crewAIInc/crewAI/commit/fb2323b3deb3ec62b3965526857e77a2264e4cd0 · [email protected]https://yerangamage.com/cves/detail/?slug=crewai-sandbox-escape · [email protected]https://yerangamage.com/cves/detail/?slug=crewai-sandbox-escape · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:21Z
    EPSS moved — → 0%
    epss
  • 13 SEP 00:00Z
    CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275
    cvelistv5