Description
CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CrewAI | CrewAI | 1.0 | — |
High · 7.5
CVE-2026-2285
EUVD-2026-17119GHSA-85jf-9mcx-32r5
CVE-2026-2285
Published Mar 30, 2026 · Updated Apr 1, 2026 · Assigned by certcc