CrewAI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH CrewAI CVE published 2026-09-13

CVE-2026-37008

CVE-2026-37008 is a high-severity vulnerability in CrewAI, a Python package, affecting its sandboxing mechanism. The issue arises from an incomplete blocklist approach at the import level, which fails to account for the entire Python object graph. This allows attackers to load modules like the C library using ctypes.CDLL(None), bypassing the sandbox. The vulnerability has a CVSS score of 8.1 and is consid [truncated]