CVE-2026-2285

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Mar 30, 2026

CISA due date

—

The record

CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.

Affected packages

Ecosystem	Package	Introduced	Fixed