CVE-2026-34451: Ts Path Bypass Incomplete Prefixcve-2026-34451-ts-path-bypass-incomplete-prefix
Validating a path using `startsWith` without ensuring a trailing path separator can allow sandbox bypasses. A path traversal attack could construct a path that resolves to a sibling directory sharing the sandbox directory's name as a prefix (e.g., escaping `/path/memories` to `/path/memories_backup`). Append `path.sep` to the root path and also verify exact
