CrewAI JSON Loader Arbitrary Local File Read (CVE-2026-2285)
CrewAI's JSON document loader takes a file path and reads it without checking whether the path stays inside the intended data folder. An attacker who can control that path — for example by crafting a document reference an agent processes — can make the loader return the contents of any readable file on the host, such as /etc/passwd, SSH keys, or .env secrets.
How the attack works
CrewAI's RAG pipeline invokes a JSON loader to bring document content into an agent's context. If the path supplied to the loader contains traversal sequences (like ../../) or an absolute path to a sensitive file, the loader follows it outside the intended directory and returns that file's contents. The agent then treats the stolen content as normal document text and may pass it along in its reasoning or to other tools. If the agent has a tool that can send output externally, the read file can be exfiltrated in a later step.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6a7a50f1-cb26-49b1-83b4-00cb6a723a7d
- Severity
- High
- CVEs
- CVE-2026-2285
Why it matters
An attacker can pull credentials, private keys, or configuration secrets off the host running the CrewAI agent, then use that data for further compromise or exfiltration — without needing direct filesystem access.
What you can do
- →Restrict the CrewAI process's file-read permissions to only the intended data directory using OS-level sandboxing or a chroot/container mount.
- →Validate and normalize any file path passed to document loaders, rejecting paths with traversal sequences or that resolve outside the allowed directory.
- →Audit what document sources and paths agents are allowed to load, especially any path built from user or tool input.
- →Monitor for loader calls referencing sensitive files (/etc/passwd, .env, ~/.ssh) or containing traversal patterns, and review recent document ingestion logs for this pattern.
Known benign look-alikes
- Legitimate document loaders referencing known-good data directories — pattern requires traversal or sensitive-file targets.
- Security advisory text quoting CVE-2026-2285 file paths.
- References to /etc/ in system administration documentation without traversal context.