fix(plugins): reject relative plugin dirs to prevent cwd fallback (CWE-426) - #3199

Open

divyansh42 wants to merge 3 commits into

tektoncd:mainfrom

divyansh42:fix/SRVKP-13570-plugin-untrusted-search-path

Commits on Sep 2, 2026

fix(plugins): reject relative plugin dirs to prevent cwd fallback (CWE-426)
divyansh42
committed
8f4ff5b
fix(plugins): validate homedir-expanded path is absolute (Copilot review)
divyansh42
committed
67d65d8
test(plugins): use TKN_PLUGINS_DIR=. to actually catch the cwd fallback
divyansh42
committed
ddfe50e