Alex d435619aba fix: validate path/URL keyword args in RagTool.add() ...

The original patch validated positional *args but left all keyword
arguments (path=, file_path=, directory_path=, url=, website=,
github_url=, youtube_url=) unvalidated, providing a trivial bypass
for both path-traversal and SSRF checks.

Applies validate_file_path() to path/file_path/directory_path kwargs
and validate_url() to url/website/github_url/youtube_url kwargs before
they reach the adapter. Adds a regression-test file covering all eight
kwarg vectors plus the two existing positional-arg checks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-07 00:01:13 -07:00

..

crewai

refactor: remove CodeInterpreterTool and deprecate code execution params (#5309)

2026-04-07 03:59:40 -03:00

crewai-files

feat: bump versions to 1.14.0a3 (#5295)

2026-04-06 05:17:10 -03:00

crewai-tools

fix: validate path/URL keyword args in RagTool.add()

2026-04-07 00:01:13 -07:00

devtools

fix: bump litellm to >=1.83.0 to address CVE-2026-35030

2026-04-07 00:41:20 +08:00