vellaveto/crewai-sandbox-escape

CrewAI SandboxPython Escape PoC

Proof of concept demonstrating that SandboxPython in CrewAI's CodeInterpreterTool has an incomplete module blocklist, allowing full sandbox escape.

The Bug

SandboxPython blocks 9 modules (os, sys, subprocess, etc.) but leaves 15 dangerous modules importable: pathlib, socket, http.client, ctypes, io, pickle, multiprocessing, threading, asyncio, urllib.request, signal, code, xml.etree, zipfile, tarfile.

Running the PoC

pip install crewai-tools
python poc_sandbox_escape.py

The PoC reproduces the exact SandboxPython class from source, verifies blocked modules are denied, then demonstrates 5 independent escapes:

1. 1.File read via pathlib — reads /etc/hostname
2. 2.DNS resolution via socket — resolves example.com
3. 3.HTTP request via http.client — GETs httpbin.org/ip
4. 4.File I/O via io.open — bypasses blocked open builtin
5. 5.C calls via ctypes — imports ctypes.CDLL

Affected

• —Package: crewai-tools
• —File: crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py
• —Class: SandboxPython
• —Root cause: Blocklist (9 modules) instead of allowlist

CWE

CWE-693: Protection Mechanism Failure