From f7676040f40316c41b5514c4633c6fc575d68f3b Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 01:13:46 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 scripts/diff-docx.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/diff-docx.js b/scripts/diff-docx.js
index fa5aa253..697ce038 100644
--- a/scripts/diff-docx.js
+++ b/scripts/diff-docx.js
@@ -27,10 +27,15 @@ async function main() {
     process.exit(1);
   }
 
-  const baselinePath = args[0];
-  const currentPath = args[1];
+  const baselinePath = path.resolve(args[0]);
+  const currentPath = path.resolve(args[1]);
   const outputIndex = args.indexOf('--output');
-  const outputPath = outputIndex !== -1 ? args[outputIndex + 1] : null;
+  const outputPath = outputIndex !== -1 ? path.resolve(args[outputIndex + 1]) : null;
+
+  if (outputPath && !outputPath.startsWith(process.cwd() + path.sep)) {
+    console.error('Output path must be within the current working directory');
+    process.exit(1);
+  }
 
   if (!fs.existsSync(baselinePath)) {
     console.error(`Baseline file not found: ${baselinePath}`);