OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.

OWL's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without any scheme, host, or IP filtering, making it exploitable by attackers. Threat actors can inject malicious URLs through prompt injection techniques to cause the server to fetch internal resources. The responses from these internal requests are returned to the agent context, potentially exposing sensitive internal network data. This vulnerability is tracked as CVE-2026-85675 and affects the camel-ai/owl project. The vulnerable code is located in owl/utils/document_toolkit.py. The lack of input validation makes this a significant security risk for deployments using this toolkit. Exploitation could lead to unauthorized access to internal services, metadata endpoints, and other restricted resources.