I Traced CrewAI's Sandbox CVE: 9 Names Missed the Runtime

·6 views

A CVE published yesterday afternoon says the Python sandbox in CrewAI, a widely used agent framework, blocked nine module names and still lost. The record's wording is blunt for a CVE: the blocklist "operates at the wrong level of abstraction." The escape it describes never uses an import statement at all. I was researching agent sandbox failures this week anyway. Between the GreyNoise agent swarm report, the SGLang pickle RCE last weekend, and Bengio's agent-misbehavior paper trending on Hacker News, every feed I follow is agent security right now. When my trending scan surfaced CVE-2026-3700

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How 913 Puzzles Became 7,304 Levels: Procedural Variation on a Precomputed Puzzle Bank

Meowdoku ships over a hundred levels and keeps growing. Every one of them has to be provably solvable. This is a Star Battle-style puzzle, so a malformed board is a dead end the player can't solve. You can either generate levels at runtime with a solver or hand-author them. Neither works well in practice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Someone Asked If My CSV Export Worked in Excel. It Didn't.

Someone asked me a question about a small feature I shipped. Seven words: "Is the exported file OK in Excel?" I said yes. The CSV was valid. RFC 4180 compliant. Every field quoted, every embedded quote escaped.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Celular apagado sigue conectado y cómo forzar un apagado real

Un celular apagado sigue conectado y forzar un apagado real se convirtió en la única defensa frente al rastreo pasivo de hardware. Presionas el botón lateral, deslizas el control en pantalla. Después, el panel de píxeles se funde en negro y crees que la comunicación ha cesado por completo. Es una ilusión óptica. El microprocesador principal entra en suspensión, pero los controladores secundarios continúan emitiendo balizas de radiofrecuencia a espaldas del usuario.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building Long-Running Payment Workflows with Spring Boot and NERV Event

Some payment operations finish in milliseconds. Others don't. Imagine a payment service that sends a request to an external payment provider. Normally, the provider responds quickly. But sometimes that operation can take several minutes — perhaps even 30 minutes.

0 comments Read more at DEV Community