CVE-2026-37008: CrewAI Python Sandbox Bypass RCE Vulnerability

CVE-2026-37008 Overview

CVE-2026-37008 affects CrewAI versions prior to commit fb2323b. The vulnerability resides in the SandboxPython class of the code_interpreter_tool, which attempts to isolate untrusted Python code using an import-name blocklist. This approach operates at the wrong level of abstraction and fails to restrict access to Python's complete runtime object graph. An attacker can invoke ctypes.CDLL(None) to load the C standard library without triggering any import statement, bypassing the sandbox and executing arbitrary native code. This weakness is distinct from CVE-2026-2275 and is categorized under [CWE-424: Improper Protection of Alternate Path].

Critical Impact
Attackers with the ability to submit code to the CrewAI code interpreter can escape the in-process sandbox and execute arbitrary native code in the host process context.

Affected Products

CrewAI framework versions before commit fb2323b3deb3ec62b3965526857e77a2264e4cd0
crewai_toolscode_interpreter_tool module using the SandboxPython execution path
Deployments that route untrusted or LLM-generated code to the in-process sandbox

Discovery Timeline

2026-09-13 - CVE-2026-37008 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-37008

Vulnerability Analysis

The SandboxPython class in code_interpreter_tool.py enforces isolation by maintaining a BLOCKED_MODULES set and intercepting import statements. This design assumes that dangerous functionality is only reachable through the import system. Python does not enforce that assumption. Objects, classes, and native bindings remain reachable through introspection, existing module references, and built-in constructors.

Calling ctypes.CDLL(None) returns a handle to the currently loaded C library without invoking __import__. From that handle, an attacker reaches system, dlopen, or any other symbol available to the interpreter process. The sandbox never observes the operation because no name in BLOCKED_MODULES is referenced.

Root Cause

The root cause is a design flaw: an import-name blocklist cannot enforce a security boundary within the same Python interpreter. Any object graph traversal, cached module reference, or already-loaded C extension provides an equivalent path. The upstream fix documents this by renaming the class docstring to INSECURE and directing users to Docker-based isolation instead of relying on in-process filtering.

Attack Vector

Exploitation requires the ability to submit Python source to the CrewAI code interpreter tool. This typically occurs through an agent workflow that accepts task inputs, prompts, or tool calls. The attack executes locally within the interpreter process but escalates to full process-level code execution, which is why the CVSS scope is marked as changed.

python

# Upstream patch to lib/crewai-tools/src/crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py
class SandboxPython:
-    """A restricted Python execution environment for running code safely.
+    """INSECURE: A restricted Python execution environment with known vulnerabilities.

-    This class provides methods to safely execute Python code by restricting access to
-    potentially dangerous modules and built-in functions. It creates a sandboxed
-    environment where harmful operations are blocked.
+    WARNING: This class does NOT provide real security isolation and is vulnerable to
+    sandbox escape attacks via Python object introspection. Attackers can recover the
+    original __import__ function and bypass all restrictions.
+
+    DO NOT USE for untrusted code execution. Use Docker containers instead.
+
+    This class attempts to restrict access to dangerous modules and built-in functions
+    but provides no real security boundary against a motivated attacker.
    """

    BLOCKED_MODULES: ClassVar[set[str]] = {

Source: GitHub Commit fb2323b3

Detection Methods for CVE-2026-37008

Indicators of Compromise

Python interpreter processes that spawn unexpected child processes such as /bin/sh, bash, or cmd.exe from a CrewAI worker.
Loading of shared libraries via ctypes.CDLL or ctypes.cdll.LoadLibrary in code interpreter execution logs.
Unexpected outbound network connections originating from the CrewAI agent process.
Access to files outside the sandbox working directory by the CrewAI process.

Detection Strategies

Instrument the code interpreter tool to log all submitted source and flag tokens including ctypes, CDLL, __builtins__, __globals__, and __subclasses__.
Monitor Linux execve and ptrace calls, or Windows CreateProcess events, that originate from the Python interpreter hosting the CrewAI agent.
Alert on file descriptors opened to /proc/self/mem, /etc/shadow, or credential stores by the agent process.

Monitoring Recommendations

Forward runtime telemetry from CrewAI hosts into a centralized data lake for correlation with agent activity and prompt inputs.
Baseline the syscall and network profile of the CrewAI worker, then alert on deviations such as new library loads or DNS queries.
Retain prompt and tool-call histories long enough to reconstruct the input that triggered any suspicious runtime behavior.

How to Mitigate CVE-2026-37008

Immediate Actions Required

Update CrewAI to a build that includes commit fb2323b3deb3ec62b3965526857e77a2264e4cd0 or later.
Stop routing untrusted code to the in-process SandboxPython path and switch the code interpreter tool to the Docker-backed execution mode.
Audit existing agent workflows to confirm no user-controlled input reaches the interpreter without a container boundary.

Patch Information

The upstream fix is published as commit fb2323b3deb3ec62b3965526857e77a2264e4cd0 in the CrewAI repository. The patch relabels SandboxPython as insecure and directs operators to use Docker containers for isolation rather than relying on the Python-level blocklist. See the GitHub Commit fb2323b3 for the full diff and the CVE details writeup for additional context. Background on the abused primitive is documented in the Python ctypes Documentation.

Workarounds

Execute the code interpreter tool inside a rootless container with no host network access and a read-only filesystem.
Apply Linux seccomp or AppArmor profiles to the interpreter process to block execve, ptrace, and raw socket calls.
Disable the code_interpreter_tool entirely for agent workflows that do not require dynamic code execution.

bash

# Run the CrewAI code interpreter inside a restricted Docker container
docker run --rm \
  --network=none \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --pids-limit=64 \
  --memory=512m \
  -v "$PWD/workdir:/workdir:rw" \
  -w /workdir \
  python:3.12-slim python /workdir/task.py