crewai - 💡(How to fix) Fix [FEATURE]Architecture Proposal: Hardened Fallback Sandbox via VAREK AST Engine (CVE-2026-2287 Mitigation) [1 comments, 2 participants]

Feature Area

Core functionality

Is your feature request related to a an existing bug? Please link it here.

The Vulnerability

Currently, if CrewAI's Docker container fails or is unavailable, the system relies on an insecure Python fallback. This fallback is highly susceptible to "Agent Sandbox Escapes," specifically via arbitrary C function calls using the ctypes module (as highlighted in recent CVE reports).

The Proposed Architecture: VarekASTAnalyzer

Relying on standard software-level string matching to block modules is easily bypassed by LLM obfuscation. I propose integrating a VAREK AST Boundary as the mandatory fail-safe before code hits the Python exec() function.

Instead of regex, VAREK:

1. Compiles the agent's payload into an Abstract Syntax Tree (AST).
2. Performs deep static analysis to identify forbidden module imports (like ctypes, os, sys), regardless of how the LLM formats or hides them.
3. Triggers a physical "Kinetic Intercept," halting execution in milliseconds before the payload reaches the OS kernel.

Proof of Concept

I have built and verified this intercept using Gemini 2.5 Flash generating a ctypes memory exploit. The VAREK AST engine successfully snapped the execution thread. View the Intercept Log Here: https://github.com/kwdoug63/varek/blob/main/06-crewai-gemini-ast-intercept.ipynb

Would João and the engineering team be open to a PR implementing this AST boundary for the Docker fallback?

Describe the solution you'd like

Implement a VarekASTAnalyzer class within the Docker fallback execution path. This component will intercept the generated agent payload and parse it into an Abstract Syntax Tree (AST) for deep static analysis. If restricted system-level modules (like ctypes, os, or sys) are detected in the tree, VAREK will block the execution thread before it reaches exec(), effectively closing the CVE-2026-2287 loophole.

Describe alternatives you've considered

1. Regex/String Filtering: Attempting to block ctypes using basic string matching. I rejected this because LLMs can easily bypass regex using string concatenation (e.g., __import__('ct' + 'ypes')) or Unicode encoding.
2. Removing the Fallback Entirely: Forcing the system to crash if Docker is unavailable. I rejected this because it severely degrades the user experience and reliability of CrewAI agents in production environments.
3. Restricted eval() / exec(): Attempting to restrict the global/local dictionary in Python. I rejected this because Python's official security documentation explicitly states that restricted execution is notoriously unsafe and can be bypassed without a structural parser like an AST boundary.

Additional context

No response

Willingness to Contribute

Yes, I'd be happy to submit a pull request