{
 "public_id": "AIR-2026-0082",
 "incident_id": "2026-03-crewai-code-interpreter-and-tool-flaws",
 "date_disclosed": "2026-03-30",
 "date_occurred": null,
 "title": "CrewAI cluster: CodeInterpreter silently falls back out of Docker to an escapable Python sandbox, plus SSRF and arbitrary file read in the RAG tools",
 "class": "responsible_disclosure",
 "attack_surface": "agent_framework",
 "initial_vector": "agent_generated_code_and_runtime_supplied_urls",
 "agent_capability_abused": [
  "code_interpreter",
  "rag_url_fetch",
  "json_file_loading"
 ],
 "target_product": "CrewAI and crewai-tools",
 "target_vendor": "CrewAI Inc.",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "sandbox_escape",
  "ssrf",
  "arbitrary_file_read"
 ],
 "blast_radius": "CrewAI deployments using CodeInterpreter without a reachable Docker daemon, and any CrewAI RAG tool taking a runtime URL",
 "cve": [
  "CVE-2026-2275",
  "CVE-2026-2287",
  "CVE-2026-2286",
  "CVE-2026-2285"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_fail_open",
   "code_interpreter",
   "ssrf",
   "arbitrary_file_read",
   "cwe_749",
   "cwe_918"
  ]
 },
 "defense_present": "Docker-based isolation for the CodeInterpreter tool, and URL validation in the RAG search tools",
 "defense_bypassed": true,
 "fix_shipped": "per-CVE patches in CrewAI and crewai-tools; the CodeInterpreter fallback path was the primary fix",
 "primary_sources": [
  "https://github.com/advisories/GHSA-5w94-5wxp-rc42",
  "https://github.com/advisories/GHSA-pgf5-gw7r-wxg7"
 ],
 "verified_quote": "The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling.",
 "confidence": "high",
 "notes": "Four advisories published the same day (2026-03-30) and grouped as one disclosure event: CVE-2026-2275 (CodeInterpreter Docker-to-SandboxPython fallback, CVSS 9.6 Critical, CWE-749), CVE-2026-2287 (Docker runtime check failure, Critical), CVE-2026-2286 (SSRF in RAG search tools via unvalidated runtime URLs, CVSS 9.8 Critical, CWE-918 - 'enables content acquisition from internal and cloud services'), CVE-2026-2285 (JSON loader arbitrary file read, High). Later separate crewai-tools advisories CVE-2026-37007 (FileWriterTool) and CVE-2026-37009 (SQL injection in NL2SQLTool) are not covered here. This is the fail-open-sandbox pattern that Microsoft predicted would recur across frameworks.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Insecure Code Generation",
 "risk_sub_secondary": [
  "Tool & Function Call Extraction / Abuse",
  "Server-Side Request Forgery via LLM",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the code interpreter executed agent-generated code outside Docker",
 "vector_family": "other",
 "vector_detail": "agent_generated_code_and_runtime_supplied_urls",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-2275",
   "CVE-2026-2287",
   "CVE-2026-2286",
   "CVE-2026-2285"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "crewai",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "hallucination",
 "eai_domain": "agent_output_quality",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Insecure Code Generation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}