CVE-2026-37008: CrewAI: sandbox escape via ctypes bypasses blocklist

HIGHPoC AVAILABLECISA: ATTEND

Published September 13, 2026

CISO Take

CrewAI's Python code-execution sandbox blocks dangerous modules by name at import time, but this does not stop code from reaching the same capabilities through Python's object graph, such as loading the C library with ctypes.CDLL(None) and no import statement. Any agent allowed to run model-generated code in this sandbox should be treated as able to execute arbitrary native code on the host, and the changed scope in the CVSS vector (S:C) reflects that the sandbox boundary is the broken control. Exploitation requires local access and is rated high complexity, and the EPSS score is low (0.00163), yet the model places it in the top 95th percentile. A public PoC exists, CISA SSVC says ATTEND, and it is not in CISA KEV. Upgrade to a CrewAI build that includes commit fb2323b, and until then disable or isolate code-interpreter tools, running them only in a container or VM with no credentials, no network egress and no sensitive mounts.

Sources:NVDEPSSCISA SSVCATLASGitHub (crewAI commit fb2323b)

What is the risk?

High (CVSS 8.1). The attack is local with high complexity and needs no privileges or user interaction. The scope change means a successful exploit escapes the sandbox and affects the host, giving high confidentiality and integrity impact and limited availability impact. The EPSS score of 0.00163 indicates low near-term mass exploitation, but a public PoC exists and the SSVC decision is ATTEND. Exposure depends on whether untrusted or prompt-injectable content can drive the agent's code-execution tool. Deployments that expose such agents to external input carry the highest risk. Package-level data (dependents, OpenSSF score, repository activity) is unavailable, so blast radius is uncertain.

How does the attack unfold?

Initial Access

Attacker gets malicious instructions or code in front of a CrewAI agent via prompt injection or direct control of agent input.

AML.T0051.001

Sandbox Escape

The agent's code-execution tool runs a snippet that calls ctypes.CDLL(None) to load libc without any blocked import.

AML.T0105

Native Code Execution

The attacker uses libc calls to run commands or system calls on the host outside the sandbox restrictions.

AML.T0050

Impact

Credentials, API keys and local data are stolen, and the host is used for lateral movement or abuse of connected tools.

AML.T0055

Initial Access

Attacker gets malicious instructions or code in front of a CrewAI agent via prompt injection or direct control of agent input.

AML.T0051.001

Sandbox Escape

The agent's code-execution tool runs a snippet that calls ctypes.CDLL(None) to load libc without any blocked import.

AML.T0105

Native Code Execution

The attacker uses libc calls to run commands or system calls on the host outside the sandbox restrictions.

AML.T0050

Impact

Credentials, API keys and local data are stolen, and the host is used for lateral movement or abuse of connected tools.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
CrewAI	pip	—	No patch
60.4K371 dependentsPushed 4d ago14% patched~66d to patchFull package profile →

Do you use CrewAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACHigh

PRNone

UINone

SChanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Upgrade CrewAI to a release that contains commit fb2323b3deb3ec62b3965526857e77a2264e4cd0 or later, and confirm the fix is present in your installed version. 2) Until patched, disable the code interpreter or code execution tools for agents, or run them only in Docker mode or in a dedicated VM or container. 3) Do not rely on in-process Python sandboxes. Use OS-level isolation such as a non-root user, seccomp or AppArmor profiles, read-only filesystems, no mounted secrets and egress filtering. 4) Reduce secrets in agent environments and use short-lived, scoped credentials. 5) Detection: monitor agent hosts for unexpected use of ctypes, dlopen or libc loading, child process spawns, and unusual outbound connections from agent processes. Review agent logs for generated code that references ctypes, CDLL, or the object-graph traversal pattern (__subclasses__, __globals__).

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPrompt InjectionAgentFrameworkPluginAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0097- Virtualization/Sandbox Evasion AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and mechanisms for deactivating AI systems

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-37008?

Is CVE-2026-37008 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-37008, increasing the risk of exploitation.

How to fix CVE-2026-37008?

1) Upgrade CrewAI to a release that contains commit fb2323b3deb3ec62b3965526857e77a2264e4cd0 or later, and confirm the fix is present in your installed version. 2) Until patched, disable the code interpreter or code execution tools for agents, or run them only in Docker mode or in a dedicated VM or container. 3) Do not rely on in-process Python sandboxes. Use OS-level isolation such as a non-root user, seccomp or AppArmor profiles, read-only filesystems, no mounted secrets and egress filtering. 4) Reduce secrets in agent environments and use short-lived, scoped credentials. 5) Detection: monitor agent hosts for unexpected use of ctypes, dlopen or libc loading, child process spawns, and unusual outbound connections from agent processes. Review agent logs for generated code that references ctypes, CDLL, or the object-graph traversal pattern (__subclasses__, __globals__).

What systems are affected by CVE-2026-37008?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, code interpreter tools, LLM agent sandboxes.

What is the CVSS score for CVE-2026-37008?

CVE-2026-37008 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationcode interpreter toolsLLM agent sandboxes

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0097Virtualization/Sandbox Evasion

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

Exploitation Scenario

An attacker plants an indirect prompt injection in a document, web page or ticket that a CrewAI research agent ingests. The injected instructions get the agent to run a Python snippet in its code-execution tool. The snippet calls ctypes.CDLL(None) to load the C library without any import the blocklist would catch, then uses it to invoke system calls or spawn a shell. The attacker reads environment variables containing LLM and cloud API keys, steals local data, and uses the host as a foothold for lateral movement or to abuse the agent's connected tools.

Weaknesses (CWE)

CWE-424Improper Protection of Alternate PathPrimary CWE-424Improper Protection of Alternate Path

CWE-424 — Improper Protection of Alternate Path: The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.