fix: add path and URL validation to RAG tools

[alex-clawd]

Problem

RAG search tools (JSONSearchTool, CSVSearchTool, PDFSearchTool, etc.) accept file paths and URLs at runtime from the LLM with no validation. This allows:

• File reads: LLM passes /etc/passwd or ../../secrets.env → tool reads it
• SSRF: LLM passes http://169.254.169.254/ → tool fetches cloud metadata
• file:// URLs: file:///etc/shadow was explicitly supported in data_types.py

Fix

New utility module: crewai_tools.utilities.safe_path

validate_file_path(path, base_dir)

• Resolves symlinks and ../ traversal via os.path.realpath()
• Ensures resolved path is within base_dir (defaults to cwd)
• Rejects escape attempts

validate_url(url)

• Blocks file:// scheme entirely
• For http/https: resolves DNS, blocks private/reserved IPs:
  • 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8
  • 169.254.0.0/16 (cloud metadata), 0.0.0.0, ::1, fc00::/7

Applied in:

• RagTool.add() — validates all paths/URLs before passing to adapter (catches all RAG tools)
• DataTypes.from_content() — removed file:// scheme support

Backward compatibility:

Set CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true to bypass all validation. Logs a warning when active.

Tests

27 tests covering: path traversal, symlinks, absolute paths, file:// URLs, private IPs, cloud metadata, IPv6 localhost, unresolvable hosts, valid paths/URLs, and the escape hatch env var.

Breaking Changes

• file:// URLs no longer work in RAG tools (use file paths instead)
• File paths outside the working directory are blocked by default
• URLs to private/internal networks are blocked by default

All can be re-enabled with CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true.

---

Note

Medium Risk
Introduces stricter input validation for RAG tools (blocking file://, private-network URLs, and paths outside the working directory by default), which can break existing workflows that relied on those inputs. Core runtime behavior changes are guarded by an escape-hatch env var and covered by new tests.

Overview
Hardens RAG search tools against unsafe runtime inputs. RagTool.add() now validates positional and keyword inputs as either safe file paths (must resolve under the current working directory) or safe http/https URLs (blocks file:// and private/reserved IP ranges to mitigate SSRF), with an opt-out via CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true.

Adds a new utilities/safe_path.py module plus focused test coverage, updates DirectorySearchTool to validate directories before indexing, and tightens DataTypes.from_content() to stop treating file:// as a URL type. Docs across locales are updated to describe the new security behavior and to mark CodeInterpreterTool / allow_code_execution / code_execution_mode as deprecated/removed.

^{Reviewed by Cursor Bugbot for commit a3d3ef0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 892ee94. Configure here.}