CrewAI’s CodeInterpreter tool is designed to run user‑supplied Python code within a Docker container. When Docker is unavailable, the tool falls back to a component called SandboxPython. This fallback path allows the execution of arbitrary C functions, giving attackers the ability to run malicious code on the host system. The vulnerability is identified as CWE‑749 and can result in complete compromise of any machine running the vulnerable instance.

The affected product is CrewAI, specifically installations that include the CodeInterpreter functionality. No explicit version information was provided, so all releases that provide this tool should be considered vulnerable until a patch is issued.

The CVSS score of 9.6 indicates critical severity and the EPSS score of less than 1% suggests a low current exploitation probability, yet the potential impact remains severe due to the ability to execute arbitrary code on the host. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the CodeInterpreter endpoint can be accessed over a network connection. An attacker who can trigger the Docker fallback can invoke arbitrary C functions and gain full control of the underlying operating system.