CrewAI Arbitrary Local File Read Vulnerability in JSON Loader Tool

An arbitrary local file read vulnerability has been identified in CrewAI's JSON loader tool. This vulnerability arises because the tool reads files without proper path validation, allowing access to files on the server. The issue is part of a broader set of vulnerabilities in CrewAI, including remote code execution and server-side request forgery.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could lead to unauthorized access to sensitive files on the server.

Remediation

Users are advised to remove or restrict the Code Interpreter Tool wherever possible and to monitor Docker availability to prevent fallback to insecure sandbox modes.