CrewAI fails to confirm that Docker is running during its operation, and if Docker is not active it falls back to a sandbox mode that unintentionally permits remote code execution. This vulnerability is a code injection flaw that allows an attacker to run arbitrary code with the permissions of the CrewAI process, potentially compromising the host system.

The affected product is CrewAI, version 1.0. Systems running this edition should verify whether they have later releases.

The CVSS score of 9.8 indicates a critical rating, and the EPSS score of less than 1% suggests that, at this moment, exploitation is unlikely in the wild. Nonetheless, the vulnerability is not listed in CISA's KEV catalog. An attacker could exploit the fallback sandbox by triggering it, as the description implies that the lack of Docker health checks allows the compromise vector to be active.