{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2275", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-02-10T12:06:47.960Z", "datePublished": "2026-03-30T15:50:25.922Z", "dateUpdated": "2026-03-30T15:50:25.922Z"}, "containers": {"cna": {"title": "CVE-2026-2275", "descriptions": [{"lang": "en", "value": "The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "CrewAI", "product": "CrewAI", "versions": [{"status": "affected", "version": "1.0"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "references": [{"url": "https://docs.crewai.com/en/tools/ai-ml/codeinterpretertool"}, {"url": "https://www.kb.cert.org/vuls/id/221883"}], "x_generator": {"engine": "VINCE 3.0.34", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-2275"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-03-30T15:50:25.922Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling."}], "id": "CVE-2026-2275", "lastModified": "2026-03-30T16:16:04.557", "metrics": {}, "published": "2026-03-30T16:16:04.557", "references": [{"source": "[email protected]", "url": "https://docs.crewai.com/en/tools/ai-ml/codeinterpretertool"}, {"source": "[email protected]", "url": "https://www.kb.cert.org/vuls/id/221883"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received"}

{}

{"analysis": {"en": {"generated_at": "2026-03-30T17:22:39.714100+00:00", "value": {"mitigation_remediation": ["Apply the latest CrewAI updates that address the CodeInterpreter fallback issue.", "If an update is pending, restrict access to the CodeInterpreter service to trusted users.", "Configure the application to permanently disable the Docker fallback or force Docker usage.", "Monitor logs for any anomalous invocation of C functions via the CodeInterpreter tool."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the CrewAI CodeInterpreter component. No specific version details are provided; all installations of the CodeInterpreter tool without patches are potentially vulnerable.", "description_and_impact": "CrewAI\u2019s CodeInterpreter tool has a flaw where it falls back to a sandboxed Python execution environment instead of using Docker when Docker is unavailable. This fallback permits the execution of arbitrary C functions, effectively enabling remote code execution. The weakness lies in improper restriction of operations, allowing an attacker to run code beyond intended boundaries.", "risk_and_exploitability": "Because the flaw can be triggered by any user of the affected application, the risk is significant. The CVSS score is not publicly disclosed, and EPSS data is missing, but remote code execution generally carries high severity. The vulnerability is not listed in the CISA KEV catalog, yet the lack of a CVSS score does not lessen the potential for exploitation. Attackers could likely exploit the vulnerability by using normal interaction with the CodeInterpreter endpoint, as the fallback is automatic when Docker is unreachable."}}}}, "created": "2026-03-30T20:55:34.606763+00:00", "title": "RCE in CrewAI CodeInterpreter via SandboxPython fallback", "updated": "2026-03-30T20:55:34.606796+00:00", "vendors": [], "weaknesses": ["CWE-94", "CWE-79"]}