RootCauseunvalidated
it doesn't verify the path actually contains a CWD prefix — When stripping CWD prefixes from failed paths. Tension: allowing specially-crafted paths to bypass validation. Outcome: The function only checks for %pipe% or | device specifiers at the START of paths, not in the middle.
b26367e5-82b8-4831-863a-df5dee39489b
it doesn't verify the path actually contains a CWD prefix — When stripping CWD prefixes from failed paths. Tension: allowing specially-crafted paths to bypass validation. Outcome: The function only checks for %pipe% or | device specifiers at the START of paths, not in the middle.