PT-2026-41808

Summary validate path security uses string-prefix containment startswith for boundary checks. This allows paths that are outside the intended project directory but share its prefix string e.g., /tmp/potato proj demo evil/... vs /tmp/potato proj demo to be accepted. Details Affected source locatio...