vellaveto / crewai-sandbox-escape

CrewAI SandboxPython Escape PoC

Proof of concept demonstrating that SandboxPython in CrewAI's CodeInterpreterTool has an incomplete module blocklist, allowing full sandbox escape.

The Bug

SandboxPython blocks 9 modules ( os , sys , subprocess , etc.) but leaves 15 dangerous modules importable: pathlib , socket , http.client , ctypes , io , pickle , multiprocessing , threading , asyncio , urllib.request , signal , code , xml.etree , zipfile , tarfile .

Running the PoC

pip install crewai-tools
python poc_sandbox_escape.py

The PoC reproduces the exact SandboxPython class from source, verifies blocked modules are denied, then demonstrates 5 independent escapes:

1. File read via pathlib — reads /etc/hostname
2. DNS resolution via socket — resolves example.com
3. HTTP request via http.client — GETs httpbin.org/ip
4. File I/O via io.open — bypasses blocked open builtin
5. C calls via ctypes — imports ctypes.CDLL

Affected

• Package: crewai-tools
• File: crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py
• Class: SandboxPython
• Root cause: Blocklist (9 modules) instead of allowlist

CWE

CWE-693: Protection Mechanism Failure