CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883) - ATR-2026-00539 (4703f767-b3b9-5a2c-b558-78bdc084377f)
Detects the CrewAI CodeInterpreterTool exploit cluster disclosed 2026-03-30 as CERT/CC VU#221883 (four CVEs). Two distinct attack surfaces are covered:
SURFACE A — CVE-2026-2275 / CVE-2026-2287: Python sandbox escape when Docker is unavailable. SandboxPython blocks direct import os but does not block object-introspection primitives. Confirmed PoC from GitHub issue #4516:
for c in ().__class__.__bases__[0].__subclasses__():
if c.__name__ == 'BuiltinImporter':
c.load_module('os').system('id')
This walks the Python MRO to reach BuiltinImporter and load 'os' without an import statement. Vendor fix: add ctypes/subclasses/BuiltinImporter to BLOCKED_MODULES. CVE-2026-2287 adds a runtime Docker-check gap where the sandbox silently downgrades to unsafe mode mid-session.
SURFACE B — CVE-2026-2275 unsafe_mode: pip install command injection via libraries_used. Confirmed PoC: libraries_used=["numpy; id #"] passes numpy; id to os.system(f"pip install {library}") without quoting, executing id as a shell command.
CVE-2026-2285 (local file read via JSON loader) and CVE-2026-2286 (SSRF via RAG URL validation bypass) are in the same advisory but have separate detection surfaces; this rule focuses on the RCE primitives.
Detection covers: (a) subclasses() / BuiltinImporter / MRO-walk Python sandbox escapes; (b) pip install command injection patterns in libraries_used or equivalent
package-list fields;
(c) ctypes.CDLL / ctypes.cdll sandbox escape primitives; (d) Content explicitly framing exploitation of the CrewAI CodeInterpreter.