CVE-2026-37009: SQL Injection
Published Aug 27, 2026
·Updated
A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sqlquery argument.
Affected Software
1 affected component
NL2SQLTool=1.10.2rc1
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs the ability to supply a value to the NL2SQLTool sql_query argument. The vulnerability is remotely exploitable because that argument is not sanitized before SQL commands are executed.
2
What systems are exposed?
Deployments using NL2SQLTool in crewai-tools v1.10.2rc1 are identified as affected. The available information does not state whether other versions or configurations are affected.
3
What can an attacker do if exploitation succeeds?
A successful exploit can allow execution of arbitrary SQL commands through the vulnerable NL2SQLTool component.