diff --git a/sdk/typescript/src/findings-import.ts b/sdk/typescript/src/findings-import.ts
index 6ca87b12b..d316560d0 100644
--- a/sdk/typescript/src/findings-import.ts
+++ b/sdk/typescript/src/findings-import.ts
@@ -164,6 +164,11 @@ export async function parseImportedFindings(
       );
     }
     occurrenceIds.add(finding.occurrenceId);
+    if (finding.locations.some((location) => !safeFindingPath(location.path))) {
+      throw new CodexSecurityError(
+        `Findings JSON finding ${index + 1} has an invalid path.`,
+      );
+    }
   }
   return document.findings;
 }
diff --git a/sdk/typescript/tests-ts/findings-import.test.ts b/sdk/typescript/tests-ts/findings-import.test.ts
index 6c4ba695f..9a66780f0 100644
--- a/sdk/typescript/tests-ts/findings-import.test.ts
+++ b/sdk/typescript/tests-ts/findings-import.test.ts
@@ -145,4 +145,19 @@ describe("findings import formats", () => {
       ),
     ).rejects.toThrow("duplicate occurrenceId");
   });
+
+  test("rejects an unsafe finding location path in either import format", async () => {
+    const document = await sourceDocument();
+    document.findings[0]!.locations[0]!.path = "../../../outside/secrets.env";
+    await expect(
+      parseImportedFindings(JSON.stringify(document), "json", PLUGIN_ROOT),
+    ).rejects.toThrow("has an invalid path");
+    await expect(
+      parseImportedFindings(
+        CSV_SOURCE.replace("src/extract.ts", "../../../outside/secrets.env"),
+        "csv",
+        PLUGIN_ROOT,
+      ),
+    ).rejects.toThrow("has an invalid path");
+  });
 });