vid-motion-graphics

The fragment does not show intentional malware or data exfiltration. It is a rendering utility, but the local HTTP server has a path-traversal risk because decoded request paths are used without containment checks, and malformed URL encoding may cause an uncaught exception. Running Chromium with --no-sandbox increases impact if untrusted page content is processed. Restrict requests to paths resolved beneath SERVE_DIR, handle decode errors, bind explicitly to localhost, and avoid --no-sandbox where possible.