{"data":{"id":"e3c9d7fc-b15e-4c9f-9381-fe2e6def7c76","title":"CVE-2026-37008: CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different…","summary":"CrewAI versions before fb2323b rely on a Python blocklist that blocks modules at import time. This approach works at the wrong level of abstraction and does not stop access to Python's full object graph, so a different flaw from CVE-2026-2275 remains. The source gives ctypes.CDLL(None) as an example: it loads the C library without any import statement.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-37008","publishedAt":"2026-09-13T21:17:01.303Z","cveId":"CVE-2026-37008","cweIds":["CWE-424"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["CrewAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"CrewAI Python blocklist bypass via ctypes loading the C library","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","attackVector":"local","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00163,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":["GHSA-2q68-3cp7-72v9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T06:08:35.093Z","patchAvailable":null,"disclosureDate":"2026-09-13T21:17:01.303Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}