CVE-2026-37008

Improper sandboxing: import blocking misses full Python runtime, allowing unsafe ctypes use.

• CVSS 8.1
• 424
• Design Defects
• Local

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

CVE

CVE-2026-37008

CWE

424

CVSS base score

8.1

Published

2026-09-13

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

Python

Solution

Upgrade CrewAI to version 2.1.0 or later, which includes the fix for this sandbox‑bypass issue.

import ctypes

class Sandbox:
    def __init__(self):
        self.allowed_functions = {'len', 'sum'}

    def evaluate(self, code: str):
        # VULNERABLE: loading arbitrary native library via ctypes
        libc = ctypes.CDLL(None)  # loads the entire C runtime
        exec(code, {'__builtins__': {name: getattr(__builtins__, name) for name in self.allowed_functions}})

import ctypes

class Sandbox:
    def __init__(self):
        self.allowed_functions = {'len', 'sum'}

    def evaluate(self, code: str):
        # FIX: removed unsafe ctypes load; sandbox now restricts to pure Python builtins
        exec(code, {'__builtins__': {name: getattr(__builtins__, name) for name in self.allowed_functions}})

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202637008,
  title        = {{Improper sandboxing: import blocking misses full Python runtime, allowing unsafe ctypes use.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-37008},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-37008/}}
}