title: CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)
id: ATR-2026-00539
rule_version: 1
status: experimental
description: |
  Detects the CrewAI CodeInterpreterTool exploit cluster disclosed 2026-03-30 as CERT/CC VU#221883 (four CVEs). Two distinct attack surfaces are covered:
  SURFACE A — CVE-2026-2275 / CVE-2026-2287: Python sandbox escape when Docker is unavailable. SandboxPython blocks direct `import os` but does not block object-introspection primitives. Confirmed PoC from GitHub issue #4516:
    `for c in ().__class__.__bases__[0].__subclasses__():`
    `    if c.__name__ == 'BuiltinImporter':`
    `        c.load_module('os').system('id')`
  This walks the Python MRO to reach BuiltinImporter and load 'os' without an import statement. Vendor fix: add ctypes/__subclasses__/BuiltinImporter to BLOCKED_MODULES. CVE-2026-2287 adds a runtime Docker-check gap where the sandbox silently downgrades to unsafe mode mid-session.
  SURFACE B — CVE-2026-2275 unsafe_mode: pip install command injection via libraries_used. Confirmed PoC: `libraries_used=["numpy; id #"]` passes `numpy; id` to `os.system(f"pip install {library}")` without quoting, executing `id` as a shell command.
  CVE-2026-2285 (local file read via JSON loader) and CVE-2026-2286 (SSRF via RAG URL validation bypass) are in the same advisory but have separate detection surfaces; this rule focuses on the RCE primitives.
  Detection covers: (a) __subclasses__() / BuiltinImporter / MRO-walk Python sandbox escapes; (b) pip install command injection patterns in libraries_used or equivalent
      package-list fields;
  (c) ctypes.CDLL / ctypes.cdll sandbox escape primitives; (d) Content explicitly framing exploitation of the CrewAI CodeInterpreter.
author: ATR Community
date: 2026/05/28
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM05:2025
  owasp_agentic:
    - ASI05:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0043 - Craft Adversarial Data
    - AML.T0105 - Escape to Host
  mitre_attack:
    - T1611 - Escape to Host
    - T1059.006 - Python
    - T1553 - Subvert Trust Controls
  cve:
    - CVE-2026-2275
    - CVE-2026-2287
    - CVE-2026-2285
    - CVE-2026-2286
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: |
        CVE-2026-2275/2287 allow escaping the CrewAI SandboxPython execution boundary via object-introspection chains that are not blocked by the sandbox; Article 15 cybersecurity requirements mandate that AI system code-execution sandboxes maintain isolation under adversarial inputs and do not silently degrade to unsafe modes when isolation prerequisites (Docker) are unavailable.
      strength: primary
    - article: '9'
      context: |
        Article 9 risk management must enumerate Python MRO-walk / __subclasses__ sandbox escapes and pip-install command injection via libraries_used as high-risk vectors for any agent code-execution feature.
      strength: secondary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)) would bypass or undermine that oversight.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: |
        Adversarial inputs exploiting Python introspection (__subclasses__, BuiltinImporter, ctypes) to escape sandbox boundaries or injecting shell metacharacters into pip install arguments constitute an adversarial input attack class; MP.5.1 requires these to be tracked and scanned for in agent code-execution surfaces.
      strength: primary
    - subcategory: MG.2.3
      context: |
        Risk treatment must add __subclasses__ / ctypes / BuiltinImporter to BLOCKED_MODULES and must quote library names before passing to pip install (shlex.quote or subprocess list-form), mirroring the vendor's planned fixes in CrewAI PR #4791 / #5309 / #5310 / #5315.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: |
        Operational controls under clause 8.1 must detect Python sandbox-escape primitives and pip-install injection patterns in code submitted to any agent code-interpreter layer.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (CrewAI CodeInterpreterTool Sandbox Escape and Prompt-to-Shell RCE (CVE-2026-2275 / VU#221883)) is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: python-sandbox-escape
  scan_target: both
  confidence: high
  source: cve-disclosure
  vendor_sources: crewai-vu221883
agent_source:
  type: llm_io
  framework:
    - crewai
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Python tutorial content showing __subclasses__() for educational MRO exploration without OS access or BuiltinImporter target.
    - Security research papers quoting these payload patterns for analysis — rule fires by design; evaluate context.
    - ctypes usage in legitimate scientific Python code accessing shared libraries (no os.system / subprocess follow-up).
    - requirements.txt files where package names do not contain shell metacharacters.
  conditions:
    - field: content
      operator: regex
      value: (?i)\.__subclasses__\s*\(\s*\)[^\n]{0,300}(?:BuiltinImporter|builtins|importlib|__import__|load_module\s*\(\s*["\x27]os["\x27]|ctypes)
      description: |
        __subclasses__() call followed within 300 chars by BuiltinImporter / builtins / importlib / load_module('os') / ctypes — confirmed CVE-2026-2275 MRO-walk sandbox escape chain (exact PoC from GitHub issue #4516)
    - field: content
      operator: regex
      value: (?i)\(\s*\)\s*\.__class__\s*\.__bases__\s*\[\s*0\s*\]\s*\.__subclasses__\s*\(\s*\)
      description: |
        Exact PoC chain opening sequence: ().__class__.__bases__[0].__subclasses__() — textbook Python sandbox escape entry point, confirmed in CrewAI advisory
    - field: content
      operator: regex
      value: (?i)load_module\s*\(\s*["\x27](?:os|sys|subprocess|importlib|ctypes|builtins)["\x27]\s*\)\s*\.\s*(?:system|popen|exec|spawn|getoutput|run|call|Popen|check_output)
      description: |
        load_module() loading a dangerous stdlib module and immediately calling a code-execution method — sandbox bypass that avoids direct import statements
    - field: content
      operator: regex
      value: (?i)libraries_used\s*=\s*\[[^\]]*["\x27][^"\x27]*(?:[|&`$]|;(?!\s*(?:python_(?:version|full_version)|os_name|sys_platform|platform_(?:machine|release|system|version)|implementation_(?:name|version)|extra\s|version\s|>=|<=|==|!=|~=|\d)))[^"\x27]*["\x27][^\]]*\]
      description: |
        CrewAI CodeInterpreterTool libraries_used list containing a package name with a shell metacharacter (| & ` $) or semicolon not followed by a PEP 508 environment marker — pip install command injection (Surface B PoC: "numpy; id #"). Negative lookahead excludes legitimate PEP 508 specifiers like "requests; python_version >= '3.6'".
    - field: content
      operator: regex
      value: (?i)ctypes\s*\.\s*(?:CDLL|cdll|WinDLL|OleDLL|PyDLL)\s*\(\s*[^)]{0,200}(?:libc|libpthread|kernel32|ntdll|msvcrt|\/lib\/|\/usr\/lib\/)
      description: |
        ctypes loading a system-level shared library (libc, kernel32, ntdll) — sandbox escape via C function calls, the post-escape RCE primitive referenced in CVE-2026-2275 description
    - field: content
      operator: regex
      value: (?i)(?:CrewAI|crewai|CodeInterpreterTool|code_interpreter_tool)[^\n]{0,200}(?:sandbox[^\n]{0,80}(?:escape|bypass)|ctypes|__subclasses__|BuiltinImporter|pip[^\n]{0,40}inject)
      description: |
        CrewAI / CodeInterpreterTool reference combined with sandbox-escape or injection language — explicit attack framing in skill or tool description
    - field: content
      operator: regex
      value: (?i)(?:VU#?221883|CVE-?2026-?2275|CVE-?2026-?2287)[^\n]{0,200}(?:payload|inject|exploit|bypass|__subclasses__|ctypes|SandboxPython|sandbox.escape)
      description: |
        Explicit VU#221883 / CVE-2026-2275 / CVE-2026-2287 reference combined with exploitation language — attack framing in skill or tool description
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00539] CRITICAL: CrewAI CodeInterpreterTool sandbox escape or pip-install command injection pattern detected (CVE-2026-2275/2287, VU#221883). Pattern indicates either (a) Python MRO-walk to BuiltinImporter to load 'os' without an import statement, or (b) shell metacharacters in a libraries_used argument flowing to pip install. Both primitives achieve RCE when Docker is unavailable. Block execution; disable CodeInterpreterTool until vendor PRs #4791/#5309/#5310/#5315 are merged and BLOCKED_MODULES is updated.
confidence: 84