Devin AI ed0da4a831 fix: replace eval() with safe AST-based math evaluator in AGENTS.md template ...

The Calculator tool example in the AGENTS.md template used eval() on
unsanitized LLM input, creating a remote code execution vulnerability
in every new CrewAI project.

Replace eval() with an AST-based evaluator that only supports arithmetic
operators (+, -, *, /, **) and numeric literals, preventing arbitrary
code execution while preserving calculator functionality.

Closes #5056

Co-Authored-By: João <joao@crewai.com>

2026-03-25 04:03:25 +00:00

..

a2a

feat: add a2a liteagent, auth, transport negotiation, and file support

2026-01-30 17:10:00 -05:00

agents

fix: resolve all mypy errors across crewai package

2026-03-25 06:03:43 +08:00

cassettes

Lorenze/feat/plan execute pattern (#4817)

2026-03-15 18:33:17 -07:00

cli

fix: replace eval() with safe AST-based math evaluator in AGENTS.md template

2026-03-25 04:03:25 +00:00

config

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

crew

feat: async crew support

2025-12-04 16:53:19 -05:00

events

Fix tool error causing double event scope pop (#4373)

2026-02-04 20:34:08 -03:00

experimental

fix: ensure otel span is closed

2025-12-05 13:23:26 -05:00

hooks

feat: implement before and after tool call hooks in CrewAgentExecutor… (#4287)

2026-01-27 14:56:50 -08:00

knowledge

feat: async knowledge support (#4023)

2025-12-04 10:27:52 -08:00

llms

feat: native OpenAI-compatible providers (OpenRouter, DeepSeek, Ollama, vLLM, Cerebras, Dashscope) (#5042)

2026-03-24 12:05:43 -03:00

mcp

Addressing MCP tools resolutions & eliminates all shared mutable connection (#4792)

2026-03-10 14:00:40 -04:00

memory

feat: automatic root_scope for hierarchical memory isolation (#5035)

2026-03-24 02:56:10 -03:00

pipeline

chore: restructure test env, cassettes, and conftest; fix flaky tests

2025-11-29 16:55:24 -05:00

project

fix: hash callback args correctly to ensure caching works

2025-11-05 07:19:09 -05:00

rag

New Unified Memory System (#4420)

2026-02-13 21:34:37 -03:00

security

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

skills

feat: agent skills

2026-03-24 19:03:35 +08:00

storage

New Unified Memory System (#4420)

2026-02-13 21:34:37 -03:00

task

feat: async task support (#4024)

2025-12-04 13:34:29 -08:00

telemetry

fix(telemetry): skip signal handler registration in non-main threads

2026-03-02 07:42:55 -05:00

tools

fix: pass cache_function from BaseTool to CrewStructuredTool

2026-03-20 16:04:52 -04:00

tracing

fix: add cross-process and thread-safe locking to unprotected I/O (#4827)

2026-03-13 12:28:11 -07:00

utilities

Fix lock_store crash when redis package is not installed (#4943)

2026-03-18 15:05:41 -03:00

__init__.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_agent_multimodal.py

Lorenze/feat/plan execute pattern (#4817)

2026-03-15 18:33:17 -07:00

test_async_human_feedback.py

better serialization for human feedback in flow with models defined a… (#5029)

2026-03-23 14:43:43 -07:00

test_callback.py

refactor: replace Any-typed callback and model fields with serializable types

2026-03-20 15:18:50 -04:00

test_context.py

Lorenze/imp/native tool calling (#4258)

2026-01-22 17:44:03 -08:00

test_crew_multimodal.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_crew_thread_safety.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_crew.py

fix: propagate contextvars across all thread and executor boundaries

2026-03-13 00:32:22 -04:00

test_custom_llm.py

feat: async llm support

2025-12-01 18:56:56 -05:00

test_flow_ask.py

Implement user input handling in Flows (#4490)

2026-02-16 18:41:03 -03:00

test_flow_default_override.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_flow_human_input_integration.py

refactor: extract hitl to provider pattern

2026-02-04 15:40:22 -05:00

test_flow_multimodal.py

feat: native multimodal file handling; openai responses api

2026-01-23 15:13:25 -05:00

test_flow_persistence.py

Lorenze/enh decouple executor from crew (#4209)

2026-01-20 21:44:45 -08:00

test_flow_resumability_regression.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_flow_serializer.py

feat: add flow_structure() serializer for Flow class introspection (#5021)

2026-03-23 02:31:00 -03:00

test_flow_visualization.py

fix: ensure fuzzy returns are more strict, show type warning

2025-11-24 17:35:12 -05:00

test_flow.py

fix: add missing list/dict methods to LockedListProxy and LockedDictProxy

2026-03-09 09:38:35 -04:00

test_hallucination_guardrail.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_human_feedback_decorator.py

fix: enhance LLM response handling and serialization (#4909)

2026-03-17 05:19:31 -03:00

test_human_feedback_integration.py

better serialization for human feedback in flow with models defined a… (#5029)

2026-03-23 14:43:43 -07:00

test_imports.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_llm.py

feat: native OpenAI-compatible providers (OpenRouter, DeepSeek, Ollama, vLLM, Cerebras, Dashscope) (#5042)

2026-03-24 12:05:43 -03:00

test_markdown_task.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_multimodal_validation.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00

test_project.py

refactor: replace Any-typed callback and model fields with serializable types

2026-03-20 15:18:50 -04:00

test_streaming_integration.py

chore: restructure test env, cassettes, and conftest; fix flaky tests

2025-11-29 16:55:24 -05:00

test_streaming.py

Add call_id to LLM events for correlating requests (#4281)

2026-02-03 10:10:33 -03:00

test_task_guardrails.py

fix: resolve race condition in guardrail event emission test

2026-02-03 09:06:48 -05:00

test_task.py

fix: map output_pydantic/output_json to native structured output

2026-02-25 17:13:34 -05:00

utils.py

Release/v1.0.0 (#3618)

2025-10-20 14:10:19 -07:00