CVE-2026-37009
Received Received - Intake

SQL Injection in crewai-tools NL2SQLTool

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: MITRE

Description
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-28
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-37009

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crewai nl2sqltool 1.10.2rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the NL2SQLTool component of crewai-tools version 1.10.2rc1. It allows a remote attacker to execute arbitrary SQL commands by sending a specially crafted sql_query argument that is not properly sanitized.

Impact Analysis

If exploited, this vulnerability could allow an attacker to manipulate the database behind the NL2SQLTool, potentially accessing, modifying, or deleting sensitive data. This could lead to data breaches, unauthorized access, or disruption of services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update crewai-tools to a patched version that fixes the SQL injection vulnerability in NL2SQLTool. If no patch is available, consider disabling the NL2SQLTool component or restricting access to it until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-37009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart