CVE-2026-37009

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the NL2SQLTool component of crewai-tools v1.10.2rc1. A remote attacker can execute arbitrary SQL commands via an unsanitized sql_query argument.

Risk Assessment

An attacker can gain unauthorized access to the database, steal or modify data, and in extreme cases take over the system.

Recommendation

Update crewai-tools to the latest patched version. Additionally, validate and sanitize all input arguments passed to NL2SQLTool.

Original NVD description (English source)

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.