# CrewAI SandboxPython Escape PoC

Proof of concept demonstrating that `SandboxPython` in CrewAI's `CodeInterpreterTool` has an incomplete module blocklist, allowing full sandbox escape.

## The Bug

`SandboxPython` blocks 9 modules (`os`, `sys`, `subprocess`, etc.) but leaves **15 dangerous modules** importable: `pathlib`, `socket`, `http.client`, `ctypes`, `io`, `pickle`, `multiprocessing`, `threading`, `asyncio`, `urllib.request`, `signal`, `code`, `xml.etree`, `zipfile`, `tarfile`.

## Running the PoC

```bash
pip install crewai-tools
python poc_sandbox_escape.py
```

The PoC reproduces the exact `SandboxPython` class from source, verifies blocked modules are denied, then demonstrates 5 independent escapes:

1. **File read** via `pathlib` — reads `/etc/hostname`
2. **DNS resolution** via `socket` — resolves `example.com`
3. **HTTP request** via `http.client` — GETs `httpbin.org/ip`
4. **File I/O** via `io.open` — bypasses blocked `open` builtin
5. **C calls** via `ctypes` — imports `ctypes.CDLL`

## Affected

- **Package:** `crewai-tools`
- **File:** `crewai_tools/tools/code_interpreter_tool/code_interpreter_tool.py`
- **Class:** `SandboxPython`
- **Root cause:** Blocklist (9 modules) instead of allowlist

## CWE
CWE-693: Protection Mechanism Failure