fix: prevent RCE in openURLMiddleware via URL sanitization#2758

Open

Copilot wants to merge 9 commits intomainfrom

copilot/reamtempt-url-sanitisation

Commits on Jan 27, 2026

Initial plan
Copilot
committed
fix: use strict-url-sanitise to prevent RCE vulnerability (CVE-2025-11953)

Copilot
and
huntie
committed
refactor: cache sanitizeUrl to improve performance

Copilot
and
huntie
committed
simplify: use "Invalid URL" error message, remove strict-url-sanitise mock

Copilot
and
huntie
committed
style: replace it() with test() in openURLMiddleware tests

Copilot
and
huntie
committed
refactor: use ordinary import for strict-url-sanitise

Copilot
and
huntie
committed
refactor: remove named export of openURLMiddleware, test default export

Copilot
and
huntie
committed
test: add CVE-2025-11953 test cases for Windows pipe and command exfiltration

Copilot
and
huntie
committed
test: add CVE-2025-11953 comment above second test case

Copilot
and
huntie
committed