CVE-2026-37009

Name of the Vulnerable Software and Affected Versions crewai-tools version 1.10.2rc1

Description A SQL injection issue exists in the NL2SQLTool component. A remote attacker can execute arbitrary SQL commands by providing an unsanitized sql query argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the sql query argument in the NL2SQLTool until the issue is resolved.