diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a7991b9..de3c2fba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.4.19 (May 12, 2026)
+
+- Addresses [CVE-2026-41612](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612)
+
 ## 0.4.18 (March 30, 2026)
 
 - Reuse integrated browser tabs when `livePreview.useIntegratedBrowser` setting is enabled (requires VS Code >= 1.114.0).
diff --git a/src/infoManagers/endpointManager.ts b/src/infoManagers/endpointManager.ts
index b7e08d0d..76c4c99e 100644
--- a/src/infoManagers/endpointManager.ts
+++ b/src/infoManagers/endpointManager.ts
@@ -79,7 +79,7 @@ export class EndpointManager extends Disposable {
 	private validPath(file: string): string | undefined {
 		for (const item of this.validEndpointRoots.values()) {
 			for (const fileVariations of [file, `/${file}`]) { // if it's a unix path, it will be prepended by a `/`
-				if (fileVariations.startsWith(item)) {
+				if (PathUtil.PathBeginsWith(fileVariations, item) || PathUtil.PathEquals(fileVariations, item)) {
 					return fileVariations;
 				}
 			}