CVE-2026-2285
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
Published Mar 30, 2026 · updated Jun 17, 2026 · crewai crewai
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2026 · NIST NVD
Detected
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
Jun 17, 2026 · NIST NVD
Updated
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
Affected
- cpe crewai/crewai1.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-2285
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-2285
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
nvd.nist.gov