CVE-2026-37009

MediumCVSS 6.5

Published: 27/08/2026(UTC)Updated: 08/09/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

SQL injection vulnerability in the NL2SQLTool component of crewai-tools v1.10.2rc1. A remote attacker can execute arbitrary SQL commands via an unsanitized sql_query argument.

Risk Assessment

An attacker can gain unauthorized access to the database, steal or modify data, and in extreme cases take over the system.

Recommendation

Update crewai-tools to the latest patched version. Additionally, validate and sanitize all input arguments passed to NL2SQLTool.

Other vulnerabilities in crewai-tools

CVE-2026-37007Critical
Vulnerability in the FileWriterTool component of crewai-tools <= 1.10.2rc1. A remote attacker can achieve code execution via malicious path traversal sequences in the filename argument.

Original NVD description (English source)

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS