PT-2026-29049 · Crewai · Crewai

Yarden Porat · Publicado 2026-03-30 · Atualizado 2026-04-02 · CVE-2026-2285

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CrewAI (affected versions not specified)

Description The software contains a flaw where the JSON loader tool reads files without proper path validation. This allows unauthorized access to files on the server. The issue involves an arbitrary local file read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2026-2285

Produtos afetados

Crewai

Referências · 5

• https://twitter.com/infoflowcloud/status/2039006543148949639 · Publicação no Twitter
• https://kb.cert.org/vuls/id/221883 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2039004523054690528 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2285 · Nota de Segurança
• https://twitter.com/PwrtYrdn/status/2039327529316540425 · Publicação no Twitter