Live › vulnerability › CVE-2026-92206
Go to dashboardCrewAI's load_agent_from_repository function passes a user-supplied value into a module import without restricting it. An attacker who gets a team to load a malicious agent configuration from a repository can run code as the service account running CrewAI.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| crewai | pypi | unknown (reproduced on 1.12.2; PyPI latest 1.15.22 on 2026-09-17 reported unpatched) | – |
pip show crewaifrom_repository\|load_agent_from_repository --include=*.py . Only code that loads agents from the CrewAI repository is reachable; a plain local crew is notmodule]) with no _is_trusted_tool_module / ALLOWED_TOOL_MODULE_PREFIXES check means it is unpatchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.
The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.
This page as .md · .json · in your agent: get_signal("CVE-2026-92206")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.