CVE-2026-37007

Name of the Vulnerable Software and Affected Versions crewai-tools versions prior to 1.10.3

Description A flaw in the FileWriterTool allows a remote attacker to execute arbitrary code. This is achieved by using malicious path traversal sequences—a technique used to access files and directories outside the intended folder—within the filename argument.

Recommendations Update crewai-tools to a version later than 1.10.2rc1. Avoid using the filename argument in FileWriterTool with untrusted input until the update is applied.