fix: add SSRF and path traversal protections

[greysonlalonde]

Summary

Addresses CVE-2026-2285 and CVE-2026-2286.

• validate_url blocks non-http/https schemes, private IPs, loopback, link-local, reserved addresses via DNS resolution. Applied to 11 web/scraping tools.
• validate_path confines file access to the working directory via Path.resolve() + is_relative_to(). Applied to 7 file/directory tools.

Test plan

• validate_url blocks file://, http://127.0.0.1, http://169.254.169.254
• validate_url allows https://example.com
• validate_path blocks /etc/passwd, ../../etc/passwd
• validate_path allows relative paths within CWD
• 242 existing crewai-tools tests pass

---

Note

Medium Risk
Touches many tools’ runtime inputs and adds DNS-based URL blocking, which can change behavior for previously-accepted paths/hosts and may fail in restricted-network environments. Changes are security-focused and localized but affect common scraping/file-read flows.

Overview
Adds centralized input hardening for tool-supplied file paths and URLs. A new crewai_tools.security.safe_path module validates file/directory paths by resolving symlinks and enforcing a base_dir boundary (defaulting to CWD), and validates URLs by only allowing http/https, blocking file://, and rejecting hosts that resolve to private/reserved IP ranges (SSRF protection).

These validations are now applied across multiple file, directory, RAG ingestion, and web-scraping tools (e.g., FileReadTool, DirectoryReadTool, RagTool.add, Firecrawl/Hyperbrowser/Jina/Scrapfly/Serper/Serply, OCR/Vision), with RagTool.add also rewriting validated path inputs to their resolved form to reduce symlink TOCTOU risk. The prior utilities.safe_path implementation is replaced with a backward-compatible re-export, and tests are updated to target the new module.

^{Reviewed by Cursor Bugbot for commit 4f5a9f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[iris-clawd]

Review: SSRF & Path Traversal Protections

Good security hardening overall — centralized validators applied consistently across tools. A few things to flag:

🔴 DNS Rebinding (validate_url)

The DNS resolution at validation time does not pin the resolved IP for the subsequent HTTP request. An attacker can serve a safe IP on the first lookup (validation pass) and a private IP on the second lookup (when requests.get/post resolves again). This is the classic DNS rebinding bypass for SSRF checks.

Mitigation options:

1. Return the resolved IP and force the HTTP client to connect to it directly (e.g., override the Host header or use a custom urllib3 adapter)
2. Pin the resolution with a very short-lived DNS cache per request
3. At minimum, document this limitation so we know it's a conscious tradeoff

🟡 is_private may be overly broad

ipaddress.is_private blocks RFC 1918, CGNAT (100.64.0.0/10), and Tailscale ranges (100.x.x.x). Users with crews that need to hit internal APIs (common in enterprise/Factory deployments) will get hard failures with no recourse. Consider:

• An opt-out flag or allowlist parameter on validate_url (e.g., allowed_hosts)
• Or at least document this as a known breaking change for internal-network use cases

🟡 Path validation TOCTOU

validate_path() resolves and checks the path, but the actual file open happens later. A symlink swap between validation and open could bypass the check. Low severity for most use cases, but worth noting in a security-focused PR. The canonical fix is to open() the file first, then check the fd's real path via os.fstat//proc/self/fd, but that's heavier.

🟢 Minor nits

• security/__init__.py is empty — consider re-exporting validate_url and validate_path for cleaner imports
• files_compressor_tool.py validates input_path but not any output path — if the output is user-controlled, that's a write-to-arbitrary-location gap
• brightdata_unlocker.py: validates url (correct — it's the user-supplied target), but the actual HTTP call goes to self.base_url. The validation is on the right value; just noting the indirection.

✅ What looks good

• Clean separation into security/safe_path.py and security/safe_url.py
• Consistent application across all relevant tools (11 URL, 7 path)
• Dropping the unused docker dep is a nice cleanup
• Test plan covers the key cases

The DNS rebinding gap is the main one I'd want addressed or explicitly documented before merge. The rest are lower priority. Nice work on this, Greyson. 💬 158

[iris-clawd]

Approving per request. The DNS rebinding and is_private breadth notes from my earlier review still stand as suggestions for future iteration, but the overall security posture improvement is solid and worth landing. ✅

[alex-clawd]

Rebased on main and unified the security utilities. Here's what changed:

Kept from your PR (the good stuff):

• All 18 per-tool validation calls — this wider coverage is great and extends beyond the RAG chokepoint

Unified with the already-merged #5310:

• Restored utilities/safe_path.py (our comprehensive implementation with env var escape hatch, IPv4/IPv6 separation, DNS rebinding protection)
• Restored the centralized RagTool.add() validation as the chokepoint for all RAG tools
• Removed security/ directory to avoid duplicate implementations
• Updated all per-tool imports to use from crewai_tools.utilities.safe_path import validate_file_path, validate_url

Result: Single source of truth for path/URL validation, both centralized (RAG chokepoint) and distributed (per-tool) protection layers. 37 tests passing, lint clean.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4f5a9f7. Configure here.}

[cursor]

Validation errors swallowed by try/except in VisionTool

Medium Severity

The validate_file_path call within _encode_image is wrapped by try/except Exception blocks. This catches validation errors and converts them into a generic error string, preventing security exceptions from propagating. This differs from the approach taken for other tools in the same PR, where validation was moved outside these blocks.

 

^{Reviewed by Cursor Bugbot for commit 4f5a9f7. Configure here.}