{"version":"2.1.267","anchor":"hooks-path-traversal-validation-extended-to-a-hooks-surfac","canonical_anchor":"hooks-path-traversal-validation-extended-to-a-hooks-surfac","heading":"Hooks path-traversal validation extended to a hook's 'surface' file","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267\/e\/hooks-path-traversal-validation-extended-to-a-hooks-surfac","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267","markdown":"### Hooks path-traversal validation extended to a hook's 'surface' file\n\nHook path-traversal checks now also cover a hook's 'surface' file, not just its module file\n\n**What**\n\nWhen Claude Code validates a plugin's hook configuration, it already checked the hook's module path for path traversal (an attempt to reference files outside the intended directory, e.g. using `..\/`) and existence. It now performs the same checks on the hook's `surfacePath` as well, returning a `path-traversal` or `path-not-found` error if it fails.\n\n**Why**\n\nThis closes a gap where a hook's surface file could point outside its intended directory without being caught, tightening the security checks around plugin hooks.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 2\/5"}