diff --git a/src/cleveragents/tool/path_mapper.py b/src/cleveragents/tool/path_mapper.py index cd6822787..30a31f238 100644 --- a/src/cleveragents/tool/path_mapper.py +++ b/src/cleveragents/tool/path_mapper.py @@ -183,7 +183,7 @@ def _relative_to(path: str, root: str) -> str: """Return the part of *path* relative to *root*. Uses :func:`posixpath.relpath` for canonical relative-path extraction, - consistent with :func:`_is_under`. This avoids string-slicing prefix‑collision + consistent with :func:`_is_under`. This avoids string-slicing prefix-collision attacks where an attacker filename is a literal prefix of the sandbox root (see issue #7478).