Zero-Day Vulnerability in CrewAI Framework Allows Remote Code Execution
A critical remote code execution vulnerability (CVE-2026-92206) has been discovered in the CrewAI framework, allowing attackers to execute arbitrary code by tricking users into loading malicious agent configurations.
A significant security flaw has been identified in the popular CrewAI framework, a tool designed to orchestrate autonomous AI agents. The vulnerability, tracked as CVE-2026-92206, allows remote attackers to execute arbitrary code on affected installations. This discovery was made by researchers at Trend Zero Day Initiative (ZDI), who have published details of the flaw.
The core of the vulnerability lies within the load_agent_from_repository function. This function improperly handles user-supplied arguments before using them to import a module. An attacker can exploit this by crafting a malicious agent configuration file. When a user or service loads this malicious configuration, the attacker's code can be executed within the context of the service account running CrewAI, potentially leading to a full system compromise.
Exploitation of this vulnerability requires user interaction. Specifically, a target user must be tricked into loading a malicious agent configuration file from a compromised or attacker-controlled repository. This makes it a targeted attack vector, but the potential impact remains severe, especially in environments where CrewAI is used to automate critical tasks or manage sensitive data.
The Zero Day Initiative first reported the vulnerability to the vendor on October 29, 2025. After follow-ups and a notification of intent to publish as a 0-day advisory on April 2, 2026, the advisory was publicly released on September 16, 2026. The disclosure timeline indicates a coordinated effort to inform the vendor and provide a window for remediation, though the advisory was initially published as a 0-day, suggesting a lack of immediate patches.
Given the nature of the vulnerability, which involves loading untrusted code, the primary mitigation strategy recommended by ZDI is to restrict interaction with the product. This means users should be extremely cautious about loading agent configurations from unknown or untrusted sources. Organizations using CrewAI should implement strict access controls and vetting processes for any external agent configurations.
The vulnerability was discovered by Peter Girnus, Demeng Chen, and Brandon Niemczyk, all affiliated with Trend Zero Day Initiative. Their work highlights the ongoing security challenges in the rapidly evolving field of AI orchestration tools, where complex functionalities can inadvertently introduce new attack surfaces.
While specific details on the CVSS score were not fully elaborated in the initial advisory, the description of arbitrary code execution with a CVSS score of 8.8 indicates a high-severity threat. This underscores the importance of prompt patching and security hardening for any system utilizing the CrewAI framework.
This incident serves as a reminder for developers and users of AI frameworks to prioritize security. As these tools become more integrated into enterprise workflows, vulnerabilities like CVE-2026-92206 can have far-reaching consequences, necessitating robust security practices and timely vendor responses.