diff --git a/lib/runner.js b/lib/runner.js
index b7f35e50..fff3b93f 100644
--- a/lib/runner.js
+++ b/lib/runner.js
@@ -88,6 +88,22 @@ function runner(options, callback) {
   if (options.url) {
     debug("Fetching remote CSS file: %s", options.url);
 
+    // block SSRF: only allow http(s) URLs and reject localhost / private / link-local addresses
+    var parsedUrl = new (require("url").URL)(options.url);
+    var blockedHostname =
+      /^(localhost|127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|::1)/;
+
+    if (
+      !/^https?:$/.test(parsedUrl.protocol) ||
+      blockedHostname.test(parsedUrl.hostname)
+    ) {
+      var urlErr = new Error(
+        "Fetching from this URL is not allowed: " + options.url,
+      );
+      urlErr.code = analyzer.EXIT_URL_LOADING_FAILED;
+      return callback(urlErr);
+    }
+
     // @see https://www.npmjs.com/package/node-fetch#options
     var agentOptions = {},
       requestOptions = {