diff --git a/tests/unit/executor-doubao-web.test.ts b/tests/unit/executor-doubao-web.test.ts
index 7d78469ceb..3ac5cd9015 100644
--- a/tests/unit/executor-doubao-web.test.ts
+++ b/tests/unit/executor-doubao-web.test.ts
@@ -20,7 +20,11 @@ describe("DoubaoWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("doubao.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("doubao.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=doubao.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "doubao.com" || host.endsWith(".doubao.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }
diff --git a/tests/unit/executor-poe-web.test.ts b/tests/unit/executor-poe-web.test.ts
index 726ab88e60..44324c5a79 100644
--- a/tests/unit/executor-poe-web.test.ts
+++ b/tests/unit/executor-poe-web.test.ts
@@ -20,7 +20,11 @@ describe("PoeWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("poe.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("poe.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=poe.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "poe.com" || host.endsWith(".poe.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }