CVE-2026-2285

CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cret@cert.org

Published

2026-03-30

Last modified

2026-04-01

Affected products

• Crewai (Crewai)

References

• https://www.kb.cert.org/vuls/id/221883