Executive brief
TypeSpec is a language for defining APIs and their schemas that gets compiled into OpenAPI and other formats. The OpenAPI3 code generator fails to validate the version string embedded in TypeSpec specifications before using it to construct output filenames, allowing an attacker to write files outside the intended output directory using path traversal sequences like "../../". A malicious specification could corrupt or overwrite files in locations the compiler process can access, potentially disrupting builds or damaging existing files.
Technical details
The vulnerability exists in the @typespec/openapi3 emitter's handling of @versioned decorator enum values. When the version string (e.g., from an enum member) is interpolated into the output filename template using {version} placeholder at packages/openapi3/src/openapi.ts:629-641, path separators and traversal sequences like "../" are not sanitized. The unsanitized path is then passed to emitFile() in packages/compiler/src/core/emitter-utils.ts, which constructs parent directories and writes the file without verifying the final path remains under emitterOutputDir. An attacker can craft a @versioned enum with a value like "../../../../../../tmp/TYPESPEC_PWNED/pwn" to write files outside the output tree. No authentication or user interaction is required—only a malicious .tsp specification file. The fix, merged in PR #11777, introduces sanitizePathSegment() helper to replace path separators and traversal components with underscores before interpolation.
Affected products
- Microsoft @typespec/openapi3 all versions up to and including 1.15.0
- Microsoft @typespec/compiler all versions up to and including 1.15.0
- Microsoft @typespec/json-schema all versions up to and including 1.15.0
- Microsoft @typespec/http all versions up to and including 1.15.0
Timeline
- 2026-09-08: disclosed
- 2026-08-28: patched: Fix merged in PR #11777 and commit e0f67bdf3c5a0875dfa98b475648af37caac71a6, though no patched release version identified in advisory