# CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)

- **Severity:** Critical
- **Signature ID:** `d43f0b6b-de8a-4a8a-bde8-bff5b18ea96f`
- **CVEs:** CVE-2026-2275, CVE-2026-2285, CVE-2026-2286, CVE-2026-2287
- **MITRE ATLAS:** AML.T0043 (Craft Adversarial Data), AML.T0050 (Command and Scripting Interpreter), AML.T0105 (Escape to Host)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

CrewAI's CodeInterpreterTool is meant to run Python in a restricted sandbox, but two flaws let an attacker break out of that restriction and execute arbitrary system commands. One path abuses Python's own class introspection to bypass an import block; the other abuses an unquoted shell command built from user-supplied package names.

## How the attack works

In the first attack, when Docker isn't available the tool falls back to a Python-only sandbox that blocks a plain 'import os' but doesn't block walking Python's class hierarchy (via __class__.__bases__ and __subclasses__()) to reach the BuiltinImporter class and load the 'os' module that way, giving full command execution. A related flaw lets the sandbox silently drop into this unsafe fallback mode mid-session without warning. In the second attack, the tool installs 'libraries' the agent asks for by building a shell command like 'pip install <library>' without sanitizing the input; supplying a library name such as 'numpy; id #' causes the extra shell command after the semicolon to execute. Both attacks can be triggered by data or instructions fed to the agent, such as a crafted prompt or file, not just by a human operator typing code directly.

## Why it matters

An attacker who can influence what the agent runs or what package names it installs can achieve full remote code execution on the host running the agent, potentially exposing the underlying server, data, and any credentials it can reach.

## What you can do

- Upgrade CrewAI to a version that blocks ctypes, __subclasses__, and BuiltinImporter access in the sandbox and quotes/validates package names before shelling out to pip.
- Always run the CodeInterpreterTool inside Docker or an equivalent isolated container, and alert if the tool silently falls back to non-containerized execution.
- Restrict or disable the 'install arbitrary libraries' feature, or route it through an allowlist instead of passing user/agent-supplied strings straight into a shell command.
- Monitor agent execution logs for patterns like __subclasses__(), BuiltinImporter, ctypes.CDLL, or shell metacharacters (;, &&, #) inside package-name fields.

## Known benign look-alikes

- Python tutorial content showing __subclasses__() for educational MRO exploration without OS access or BuiltinImporter target.
- Security research papers quoting these payload patterns for analysis — rule fires by design; evaluate context.
- ctypes usage in legitimate scientific Python code accessing shared libraries (no os.system / subprocess follow-up).
- requirements.txt files where package names do not contain shell metacharacters.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00539
- https://nvd.nist.gov/vuln/detail/CVE-2026-2275
- https://nvd.nist.gov/vuln/detail/CVE-2026-2287
- https://nvd.nist.gov/vuln/detail/CVE-2026-2285
- https://nvd.nist.gov/vuln/detail/CVE-2026-2286

---
Source: https://www.netzilo.com/threats/atr-crewai-codeinterpretertool-sandbox-escape-and-prompt-to-shel