CVE-2026-2297 SourcelessFileLoader does not use io.open_code()