AIKIDO-2026-61789

TL;DR

The local report preview server decides whether a response is an HTML attachment by string-matching the raw request URI path, but resolves the file it serves from a normalized path. Because the two values disagree, spelling the same attachment URL with a doubled slash or a percent-encoded slash serves the attachment without its sandbox content security policy. Script inside an HTML attachment then executes at the preview origin instead of a sandboxed document and can read and act on the surrounding report. The fix decides the attachment flag from the normalized resolved path so equivalent spellings collapse to the same answer.