Read the docs
TI-2026-78896 Aliases CVE-2026-92206GHSA-pgwr-r23p-38mr

Unsafe reflection in CrewAI agent loading allows code execution

Priority MEDIUM 40CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

CrewAI contains an unsafe reflection flaw in its load_agent_from_repository function. The function does not properly restrict a user-supplied argument before using it to import a module (CWE-470). A remote attacker can execute code in the context of the service account if a user loads a malicious agent configuration from a repository. The affected range is listed as Latest (as of 2025-10-09).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CrewAICrewAILatest (as of 2025-10-09)—No fix listedCNA
  • CrewAI VendorCrewAI Affected Latest (as of 2025-10-09) Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:*——CrewAI
  • cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:* Versions — — ·CrewAI

Remediation

The sources list no fixed version for CrewAI.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-92206
  2. 2026-10-21 Alias added: GHSA-pgwr-r23p-38mr
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-01920 The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker… CVSS 3.1CRITICAL 9.6
  • TI-2026-27985 CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level… CVSS 3.1HIGH 8.1
  • TI-2026-44463 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools CVSS 4.0HIGH 8.3
  • TI-2026-01932 Code injection in CrewAI CVSS 3.1CRITICAL 9.8
  • TI-2026-01931 Server-side request forgery in CrewAI CVSS 3.1CRITICAL 9.8
  • TI-2026-83922 Server-side request forgery in CrewAI through injected URLs CVSS 3.1CRITICAL 9.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences