CrewAI Code Interpreter flaws let agents escape sandboxes
Enabled Code Interpreter lets prompt injection escape sandbox, execute code. Researchers found four linked CrewAI flaws: a Docker fallback to unsafe SandboxPython that permits arbitrary C-level calls, an SSRF in RAG search tools, a runtime Docker-check that triggers the unsafe fallback, and a JSON loader that reads arbitrary local files. An attacker who can influence an agent with the Code Interpreter enabled or a code-execution flag set can chain these bugs to escape the sandbox and run code or read files on the host.
CVSS 9.6 CRITICAL: the CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through… EPSS 0.5% (40th percentile).