CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
| Vendor | Product | Versions |
|---|---|---|
| CrewAI | CrewAI | 1.0 |
Updated severity to HIGH, added CVSS estimate of 7.5, identified CWE-22, and marked the vulnerability as actively exploited with available exploits.
Initial creation
