vellaveto/crewai-sandbox-escape

CrewAI SandboxPython Escape PoC

Proof of concept demonstrating that SandboxPython in CrewAI's CodeInterpreterTool has an incomplete module blocklist, allowing full sandbox escape.

The Bug

SandboxPython blocks 9 modules (os, sys, subprocess, etc.) but leaves 15 dangerous modules importable: pathlib, socket, http.client, ctypes, io, pickle, multiprocessing, threading, asyncio, urllib.request, signal, code, xml.etree, zipfile, tarfile.

Running the PoC

pip install crewai-tools
python poc_sandbox_escape.py

The PoC reproduces the exact SandboxPython class from source, verifies blocked modules are denied, then demonstrates 5 independent escapes:

1. File read via pathlib — reads /etc/hostname
2. DNS resolution via socket — resolves example.com
3. HTTP request via http.client — GETs httpbin.org/ip
4. File I/O via io.open — bypasses blocked open builtin
5. C calls via ctypes — imports ctypes.CDLL

Affected

• Package: crewai-tools
• File: crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py
• Class: SandboxPython
• Root cause: Blocklist (9 modules) instead of allowlist

CWE

CWE-693: Protection Mechanism Failure