HighVulnerability
CVE-2026-37007: crewai-tools FileWriterTool code execution via path traversal in filename
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-37007
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.0%
Summary
A flaw in FileWriterTool in crewai-tools, versions up to and including 1.10.2rc1, lets a remote attacker achieve code execution. Malicious path traversal sequences in the filename argument are the vector.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
- MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
- HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database