Vyom Yadav

A path traversal issue exists in the `kubectl cp` command for clients running on Windows. When copying files from a container, the client executes the `tar` binary within the container to create an archive, which is then transferred and unpacked on the local machine. If the `tar` binary inside the container is malicious, it can generate unexpected output that allows an attacker controlling the container contents to write files to arbitrary paths on the local user's machine, subject to the local user's system permissions.

An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`.