Four CrewAI CVEs Chain Prompt Injection to Full RCE. No Patch Exists.

Security researcher Yarden Porat of Cyata disclosed four critical vulnerabilities in CrewAI, one of the most widely used agent frameworks. These aren't theoretical. They chain together, and the entry point is prompt injection.

The chain works like this: CVE-2026-2275 exploits a sandbox escape through CrewAI's SandboxPython fallback when Docker isn't available. CVE-2026-2287 achieves RCE through a Docker runtime verification failure. CVE-2026-2286 enables SSRF via unvalidated RAG search tool URLs. CVE-2026-2285 allows arbitrary file reads from unvalidated JSON loader paths. An attacker interacting with a CrewAI agent that has Code Interpreter enabled can walk from prompt injection to sandbox bypass to full remote code execution.

CERT/CC published advisory VU#221883. No official patch exists yet. The maintainers are developing mitigations including fail-closed configurations.

This lands in a week where the broader numbers are just as bad. TrinityGuard's multi-agent safety framework found a 7.1% average safety pass rate across evaluated multi-agent configurations. Seven percent. OpenClaw testing across 47 adversarial scenarios found sandbox escapes with only a 17% average defense rate. Analysis of 30,000+ skills found over 25% contained at least one vulnerability.

And here's the context that makes it sting: a 2026 Agentic AI Security Report surveying 300 enterprise leaders found 97% expect a material AI-agent-driven security incident within 12 months. Nearly half expect one within 6 months. But only 6% of security budgets are allocated to agent security.

97% expect disaster. 6% are funding defense. That's the gap.

If you're running CrewAI with Code Interpreter in anything resembling production, implement fail-closed configs today. If Docker isn't available, Code Interpreter shouldn't fall back to an unsandboxed runtime. Full stop. And if you're evaluating any agent framework, the question isn't "does it work?" It's "what happens when someone poisons the input?"