ZDI Discloses CrewAI 0-Day RCE in load_agent_from_repository, ZDI-26-706

Trend Micro’s Zero Day Initiative published ZDI-26-706 on September 16, 2026, describing a remote code execution flaw in the open-source CrewAI crewAI framework’s load_agent_from_repository path. ZDI rates the issue CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and labels the coordinated public release a 0-day advisory. User interaction is required: the target must load a malicious agent configuration from a repository.

According to the advisory, the flaw is that the process does not properly restrict a user-supplied argument before using it to import a module, so an attacker can execute code in the context of the service account after a malicious repository agent load. ZDI credits Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk of Trend Zero Day Initiative. The disclosure timeline states the issue was reported to the vendor on October 29, 2025, with follow-ups in early 2026 before the September 16 public release.

What shipped

ZDI’s stated mitigation, given the nature of the vulnerability, is to restrict interaction with the product. The advisory does not list a patched CrewAI release. Secondary aggregators map the case to CVE-2026-92206; treat that CVE ID as aggregator-reported unless a primary NVD/MITRE record is confirmed. CrewAI remains a widely used MIT-licensed multi-agent Python framework, so the disclosure lands squarely on Writeble’s AI-agents and cyber-security desks.

Primary source is the September 16, 2026 ZDI-26-706 advisory on zerodayinitiative.com.