Executive brief
Microsoft's TypeSpec OpenAPI3 emitter allows crafted input files to write YAML/JSON files outside the intended output directory. An attacker can create or overwrite files on the filesystem by injecting path traversal sequences (like `../`) into versioned enum values, potentially corrupting critical configuration files or causing service disruption if writable system files are targeted.
Technical details
This is a path traversal vulnerability (CWE-22) in the OpenAPI3 emitter for TypeSpec. The root cause lies in packages/openapi3/src/openapi.ts where an untrusted @versioned enum value is directly interpolated into a filename template using interpolatePath() without sanitization. The completed path is then passed to emitFile() in packages/compiler/src/core/emitter-utils.ts, which lacks output-root containment validation and simply calls mkdirp() and writeFile() on the supplied path. An attacker can craft a declarative .tsp file with a versioned enum member containing traversal sequences (e.g., "../../../../../../tmp/target") to write OpenAPI content to arbitrary locations writable by the compiler process. The vulnerability requires local access to invoke the TypeSpec compiler but no authentication, privileges, or JavaScript execution—only a malicious .tsp file. No patch is currently available.
Affected products
- Microsoft TypeSpec OpenAPI3 Emitter 1.15.0 and earlier
- Microsoft TypeSpec Compiler 1.15.0 and earlier
- Microsoft TypeSpec HTTP 1.15.0 and earlier
- Microsoft TypeSpec Versioning 0.85.0 and earlier
Timeline
- 2026-08-28: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-09-08: advisory: GitHub Security Advisory GHSA-2q42-4q24-7rgv published