[Security] SSRF via unrestricted URL fetch in voice_clone and play_audio

[Correctover]

Summary

The voice_clone() and play_audio() tools accept arbitrary URLs via is_url=True without validating the target, enabling SSRF attacks.

Details

# voice_clone
if is_url:
    response = requests.get(file, stream=True)  # No URL validation

# play_audio  
if is_url:
    play(requests.get(input_file_path).content)  # No URL validation

No protocol allowlisting, no host validation, no internal network blocking.

Impact

• Access cloud metadata (169.254.169.254)
• Scan internal network
• Access internal services

Suggested Fix

BLOCKED_RANGES = [
    ipaddress.ip_network("10.0.0.0/8"),
    ipaddress.ip_network("172.16.0.0/12"),
    ipaddress.ip_network("192.168.0.0/16"),
    ipaddress.ip_network("169.254.0.0/16"),
]
ALLOWED_SCHEMES = {"https"}

Reported by Correctover Security Research (https://correctover.com)