CVE-2026-55747

The CVE-2026-55747 entry concerns the pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow. The root cause is a _path(workdir, p) helper that simply wraps os.path.join(workdir, p) with no canonicalization or containment checks. Because os.path.join can preserve absolute paths and doe...