AIKIDO-2026-159054

TL;DR

The extensions sandbox providers materialize remote local sources through the shared localSources logic, which resolves host LocalFile/LocalDir paths before copying them into a provider workspace. Before the fix these local sources are not constrained to the configured source base directory, so a source path outside that directory is materialized without restriction. An application that passes attacker-influenced local source paths into a provider manifest can read host files outside the intended boundary, including through symlinked ancestors. The fix requires paths outside the base directory to be covered by manifest.extraPathGrants and preserves symlink rejection.