Devin AI a6378961f0 fix: prevent path traversal in knowledge source file paths (#4547) ...

Add path boundary validation in convert_to_path() to ensure resolved
paths stay within the knowledge directory. This prevents attackers from
using '../' sequences to read arbitrary files outside the knowledge dir.

Fixes:
- BaseFileKnowledgeSource.convert_to_path()
- ExcelKnowledgeSource.convert_to_path()
- CrewDoclingSource.validate_content() inline path construction

Added tests covering path traversal rejection and valid path acceptance.

Co-Authored-By: João <joao@crewai.com>

2026-02-20 12:56:20 +00:00

..

crewai

fix: prevent path traversal in knowledge source file paths (#4547)

2026-02-20 12:56:20 +00:00

crewai-files

feat: bump versions to 1.9.3 (#4316)

2026-01-30 14:24:25 -08:00

crewai-tools

docs: clarify NL2SQL security model and hardening guidance (#4465)

2026-02-12 10:50:29 -08:00

devtools

New Unified Memory System (#4420)

2026-02-13 21:34:37 -03:00