Restrict hook transform module loading
fix(security): restrict hook transform module loading
Restrict hook transform module loadinga0361b-fix-restrict-hook-transform-module-loading-cve-2026-28393fixrestrict hook transform module loading security
Committed by steipete
commit message
fix(security): restrict hook transform module loadingEditor assessment
This commit patches CVE-2026-28393. The header `fix(security): restrict hook transform module loading` points at the right subsystem, and `fix` is appropriate for a security restriction. The verb `restrict` is doing a lot of unstated work, though: readers cannot tell whether loading is limited to built-in modules, to a directory, or to an allowlist. With no body, the rationale for tightening module loading and the compatibility trade-off that comes with it are both missing. The message is clean and free of footer or style issues, but for a sandbox escape class of bug it undersells the change.