---
id: GHSA-2q42-4q24-7rgv
title: >-
  OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON
  outside the output tree
summary: >-
  OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON
  outside the output tree
severity: high
cvss: 7.1
cwe:
  - CWE-22
  - CWE-73
vendor: typespec
product: '@typespec/openapi3'
ecosystem: npm
affected:
  - '@typespec/openapi3 <= 1.15.0'
  - '@typespec/compiler <= 1.15.0'
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:31:10Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2q42-4q24-7rgv'
references:
  - url: >-
      https://github.com/microsoft/typespec/security/advisories/GHSA-2q42-4q24-7rgv
  - url: 'https://github.com/microsoft/typespec/pull/11777'
  - url: >-
      https://github.com/microsoft/typespec/commit/e0f67bdf3c5a0875dfa98b475648af37caac71a6
  - url: 'https://github.com/advisories/GHSA-2q42-4q24-7rgv'
tags:
  - ghsa
  - npm
ingestedAt: '2026-09-08T22:12:30.967Z'
---

## Overview

### Summary

The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into the output filename as `{version}` without sanitizing path separators or traversal components. The completed path reaches the compiler's `emitFile()`, which creates the parent directory and writes the file without verifying containment under `emitterOutputDir`.

A crafted declarative `.tsp` input can therefore create or overwrite an OpenAPI-formatted `.yaml` or `.json` file outside the configured output tree, subject to the compiler process's filesystem permissions. No executable TypeSpec extension or attacker-controlled JavaScript is required.

### Affected version

Confirmed on:

- `@typespec/compiler` `1.15.0`
- `@typespec/openapi3` `1.15.0`
- `@typespec/http` `1.15.0`
- `@typespec/versioning` `0.85.0`
- release tag commit `f30cd352f93997e04c75d48c7ace6947a1d5d07a`

The critical `openapi.ts` and `emitter-utils.ts` blobs are unchanged on main commit `365ec52b50b82cd9e1e037de4c6fcd5de7e32e90` as checked on 2026-08-19. No patched version was identified.

### Root cause

The value originates at `packages/openapi3/src/openapi.ts:592-608`:

```ts
serviceRecord.versions.push({
  service,
  version: snapshot.version!.value,
  document: document[0],
  diagnostics: document[1],
});
```

It is interpolated without path validation at `openapi.ts:629-641`:

```ts
return interpolatePath(options.outputFile, {
  "openapi-version": specVersion,
  "service-name-if-multiple": multipleService ? getNamespaceFullName(service.type) : undefined,
  "service-name": getNamespaceFullName(service.type),
  "file-type": fileType,
  version,
});
```

The path reaches `emitFile()` at `openapi.ts:392-401`. The sink at `packages/compiler/src/core/emitter-utils.ts:29-39` performs no output-root containment check:

```ts
const outputFolder = getDirectoryPath(options.path);
await program.host.mkdirp(outputFolder);
return await program.host.writeFile(options.path, content);
```

`resolvePath()` joins the template to `emitterOutputDir` before `{version}` is interpolated, so it does not see the attacker-controlled `..` components.

### Proof of concept

The relevant input in `poc/main.tsp` is:

```tsp
@versioned(Versions) namespace Svc;
enum Versions { v1: "../../../../../../../../../../tmp/TYPESPEC_PWNED/pwn" }
```

Run from PowerShell:

```powershell
cd poc
.\run-revalidation.ps1
```

The supplied Docker runner uses a digest-pinned Node base, a committed npm integrity lock, disabled runtime networking, a benign control, a 90-second timeout, and cleanup enforcement.

Observed in the preserved identity-locked replay (`1/1` attack and `1/1` negative control):

```text
negative_before=02dc7d056c2f773e56e2c1849947888b039f127ddd630c0bd76a5d7a9ca29cbd
negative_after=02dc7d056c2f773e56e2c1849947888b039f127ddd630c0bd76a5d7a9ca29cbd
attack_before=7a8067bc04e42a025de90fd7aff9be4df59f005d192f2116eecfb107d7bffd78
attack_after=2992b399c1573c9bd2130794f8554c4026bf425861f74e78b5d89ae0324b5e38
outside_file_head=openapi: 3.0.0
inside_attack_files=
```

The benign version preserved the outside canary. The crafted version replaced it with emitted OpenAPI content, and no attack output file remained under `tsp-output`.

### Impact and constraints

Proven impact is out-of-directory YAML/JSON creation or overwrite. The attacker can influence the traversal, final basename, and many strings in the OpenAPI-structured content. The extension is constrained to the selected emitter format, content is not arbitrary bytes, and the target must be writable.

This report demonstrates file corruption. Denial of service is a potential impact when a writable critical file is targeted. It does not claim file disclosure, arbitrary-byte write, deployment takeover, or code execution by a downstream consumer.

### Suggested remediation

After every filename token has been interpolated, resolve the completed destination against `emitterOutputDir` and reject any non-descendant using path-component-aware comparison. Reject or slugify absolute paths, path separators, and traversal components in spec-derived filename tokens. Add regression cases for POSIX and Windows separators, absolute values, sibling-prefix paths, and benign semantic versions.

## Affected packages

- `@typespec/openapi3 <= 1.15.0`
- `@typespec/compiler <= 1.15.0`

## Remediation

Refer to the advisory for the patched release.