What happened
Verified on the ZDI advisory: the specific flaw is in load_agent_from_repository, which fails to restrict a user-supplied argument before module import, enabling arbitrary code execution. NVD published CVE-2026-92206 on Oct 21 (CVSS 8.8); ZDI's disclosure timeline shows the report to the vendor Oct 2025 and coordinated public release Sept 2026 after no fix.
Why it matters
Agent configuration as code is the default distribution mechanism for CrewAI crews; a poisoned config in a shared/starred repo gives attackers RCE in every service that loads it — a supply-chain primitive for agent frameworks, not a network-exposed bug.
Attack vector
The target must load a malicious agent configuration from a repository; load_agent_from_repository does not restrict a user-supplied argument before using it to import a module, so the imported module's code runs in the context of the service account (unsafe reflection / arbitrary module import).
Affected systems
CrewAI crewAI framework — agent loading path (load_agent_from_repository)
Mitigation
ZDI published the advisory as a 0-day after the vendor did not respond (ZDI-26-706). Only load agent configs from trusted repositories; restrict the service account's privileges; monitor who can commit to crew repositories.