An import-name blocklist could not secure CrewAI’s old in-process Python sandbox because Python’s runtime offered routes around imports. The GitHub advisory identifies revisions before commit fb2323b as the relevant code boundary, but gives no affected or fixed package versions. CrewAI’s fix removed the insecure in-process fallback and made Docker necessary for safe code execution; a later CERT/CC update says the CodeInterpreterTool was removed from current releases.
Why did blocking nine module names fail?
The “nine names” refers to the pre-fix implementation’s BLOCKED_MODULES list, as described in a secondary technical write-up. It does not mean those nine names were the only ways out. The core problem was the approach: rejecting selected imports does not contain the complete Python interpreter when untrusted code runs inside the same process.
As an Amazon Associate I earn from qualifying purchases.
The GitHub Advisory Database’s GHSA-2q68-3cp7-72v9 explains that Python’s object graph and native interfaces can expose functionality through routes other than import statements. It gives ctypes.CDLL(None) as an example of reaching the C library without importing a module. As the advisory puts it, a within-process sandbox must account for the interpreter’s complete runtime, not just its import system.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →That is why adding more blocked module names would not provide a sound security boundary. The problem was not merely an incomplete list; it was relying on an import filter to confine code that still shared the interpreter and process.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
What does CVE-2026-37008 cover?
The advisory classifies CVE-2026-37008 as CWE-424, Improper Protection of Alternate Path, and gives it a CVSS 3.1 score of 8.1 with vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. The record was published September 13, 2026, and lists both affected and patched versions as unknown. It also does not identify package coordinates.
The useful boundary is therefore source-based: the advisory identifies CrewAI revisions before commit fb2323b, not a particular package version range. A package number by itself cannot establish whether an installation contains the fix; teams need to inspect the deployed artifact and its code or confirm the release mapping with CrewAI.
What changed in the fix?
CrewAI’s commit fb2323b, titled “Code interpreter sandbox escape (#4791),” says object introspection could recover the original __import__ function, enabling arbitrary module access and command execution on the host.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The fix removed the restricted in-process fallback and made run_code_safety() fail closed when Docker is unavailable. The commit describes Docker as required for safe code execution. It also deprecated the restricted sandbox as insecure and retained an explicit unsafe_mode=True option for users unable to use Docker, with the risks acknowledged. That option is not equivalent to safe isolation.
How can a team check whether its deployment is exposed?
- Identify the deployed artifact. Record the exact CrewAI and
crewai-toolsversions, and inspect the installed code or source revision. Look for commitfb2323bor an equivalent change removing the in-process fallback. The advisory does not provide a reliable package-version cutoff. - Inspect configuration and tool wiring. Determine whether a CodeInterpreterTool or related code-execution path is enabled, whether
allow_code_executionis set, and whether unsafe mode or custom/forked code restores an in-process fallback. Also check whether the tool was attached manually. - Verify execution isolation and failure behavior. Confirm where code actually runs and what happens when Docker or the configured execution service becomes unavailable. Safe handling should fail closed rather than silently run untrusted code inside the CrewAI process.
- Check vendor status for the deployed release. Compare the installed artifact with CrewAI’s release notes and the dated CERT/CC update below. Do not infer protection solely from a version label or from the presence of a Docker configuration.
These checks establish whether the relevant code and conditions are present; they do not replace a security review of the full application, including custom tools and agent inputs.
How is this different from the related CrewAI CVEs?
CVE-2026-37008 concerns the in-process sandbox’s blocklist/runtime-boundary flaw. CERT/CC’s VU#221883 covers a separate cluster of CrewAI issues with different triggers and impacts:
| Identifier | Reported issue and condition |
|---|---|
| CVE-2026-2275 | CodeInterpreterTool could fall back to SandboxPython when Docker could not be reached. The reported trigger is allow_code_execution=True or manually attaching the tool. |
| CVE-2026-2287 | Docker’s continued availability was not checked during runtime, allowing fallback to a sandbox that permits remote code execution. |
| CVE-2026-2286 | RAG search tools did not validate runtime URLs, creating an SSRF issue. |
| CVE-2026-2285 | A JSON loader could read arbitrary local files because paths were not validated. |
CERT/CC says the related cluster can be exploited by an attacker able to influence an agent using the Code Interpreter Tool through direct or indirect prompt injection. Reported consequences include arbitrary file reading, remote code execution, and SSRF. Those conditions and impacts should not automatically be attributed to CVE-2026-37008.
Free tools Windows power users keep installed
One-click scans. No signup required.
For the distinct CVE-2026-2287, INCIBE-CERT records a CVSS 3.1 score of 9.8 (Critical). That score is not the score for CVE-2026-37008, which the GitHub advisory rates 8.1.
Best Value
What is the current remediation status?
CERT/CC’s VU#221883 was first published March 30, 2026, and last revised May 20, 2026. In the vendor statement dated May 20, CrewAI said it had completely removed the CodeInterpreterTool, including its Docker sandbox and insecure SandboxPython fallback, deprecated allow_code_execution, and recommended external sandboxes. The statement also says current releases contain fixes and describes centralized validate_file_path() and validate_url() changes for the related file-read and SSRF issues.
That status is specific to the May 20, 2026 statement, not a guarantee about every later installation. Check the actual deployed version and configuration, particularly if the deployment uses an older release, a fork, custom tool wiring, or settings that restore unsafe execution. CERT/CC names E2B and Daytona as examples of external sandboxes; that mention does not establish their current features, compatibility, or suitability for a particular deployment.
Choosing an execution boundary
When assessing a code-execution design, compare the boundary and its failure behavior rather than treating a blocked-import list as isolation:
Quick Recap
- Isolation boundary: Does untrusted code run inside the CrewAI process, in a separate container, or in an external service?
- Unavailable-runtime behavior: Does execution stop when the container or service is unavailable, or fall back to a less isolated path?
- Compatibility: Does the deployed CrewAI release support the chosen execution method, and has the old tool or setting been removed or deprecated?
- Operational verification: Can the team verify the patched artifact, inspect the effective configuration, and monitor the execution service?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
