The configured Embed Code version is inserted directly into download URLs and paths under build/embed-code. Values containing path traversal segments such as ../../escaped can place files outside the intended cache directory and produce malformed release URLs.
Reject invalid versions early and verify that normalized installation and checksum paths remain inside build/embed-code.
The configured Embed Code version is inserted directly into download URLs and paths under
build/embed-code. Values containing path traversal segments such as../../escapedcan place files outside the intended cache directory and produce malformed release URLs.Reject invalid versions early and verify that normalized installation and checksum paths remain inside build/embed-code.