CrewAI’s CodeInterpreter tool has a flaw where it falls back to a sandboxed Python execution environment instead of using Docker when Docker is unavailable. This fallback permits the execution of arbitrary C functions, effectively enabling remote code execution. The weakness lies in improper restriction of operations, allowing an attacker to run code beyond intended boundaries.

The vulnerability affects the CrewAI CodeInterpreter component. No specific version details are provided; all installations of the CodeInterpreter tool without patches are potentially vulnerable.

Because the flaw can be triggered by any user of the affected application, the risk is significant. The CVSS score is not publicly disclosed, and EPSS data is missing, but remote code execution generally carries high severity. The vulnerability is not listed in the CISA KEV catalog, yet the lack of a CVSS score does not lessen the potential for exploitation. Attackers could likely exploit the vulnerability by using normal interaction with the CodeInterpreter endpoint, as the fallback is automatic when Docker is unreachable.