{"answers":{"affected":"4 open source packages ship an affected version, including @typespec/compiler and @typespec/openapi3.","exploited":"There is no known exploitation of GHSA-2q42-4q24-7rgv in the wild and no public exploit code.","fix":"No fix has been published for GHSA-2q42-4q24-7rgv yet. Limit exposure of the affected software until one is available.","what":"GHSA-2q42-4q24-7rgv is a path traversal vulnerability in @typespec/compiler, published on 8 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-2q42-4q24-7rgv and fix it if it is affected.\n\nWhat it is: GHSA-2q42-4q24-7rgv is a path traversal vulnerability in @typespec/compiler, published on 8 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-2q42-4q24-7rgv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @typespec/compiler (npm): affected all versions up to 1.15.0; no fix listed\n- @typespec/compiler (npm): affected all versions up to 1.15.0; no fix listed\n- @typespec/openapi3 (npm): affected all versions up to 1.15.0; no fix listed\n- @typespec/openapi3 (npm): affected all versions up to 1.15.0; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2q42-4q24-7rgv/ (Markdown: https://insights.sbomify.com/GHSA-2q42-4q24-7rgv/index.md)","id":"GHSA-2q42-4q24-7rgv","markdown":"https://insights.sbomify.com/GHSA-2q42-4q24-7rgv/index.md","name":"GHSA-2q42-4q24-7rgv","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"no_fix_stated","impacts":["data_modify"],"network_reachable":"no","non_default_config":false,"product_category":"TypeScript OpenAPI emitter","requires_auth":"none","summary":"A path traversal vulnerability in the TypeSpec OpenAPI3 emitter allows attackers to overwrite files outside the output directory via crafted version strings.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nThe `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into the output filename as `{version}` without sanitizing path separators or traversal components. The completed path reaches the compiler's `emitFile()`, which creates the parent directory and writes the file without verifying containment under `emitterOutputDir`.\n\nA crafted declarative `.tsp` input can therefore create or overwrite an OpenAPI-formatted `.yaml` or `.json` file outside the configured output tree, subject to the compiler process's filesystem permissions. No executable TypeSpec extension or attacker-controlled JavaScript is required.\n\n### Affected version\n\nConfirmed on:\n\n- `@typespec/compiler` `1.15.0`\n- `@typespec/openapi3` `1.15.0`\n- `@typespec/http` `1.15.0`\n- `@typespec/versioning` `0.85.0`\n- release tag commit `f30cd352f93997e04c75d48c7ace6947a1d5d07a`\n\nThe critical `openapi.ts` and `emitter-utils.ts` blobs are unchanged on main commit `365ec52b50b82cd9e1e037de4c6fcd5de7e32e90` as checked on 2026-08-19. No patched version was identified.\n\n### Root cause\n\nThe value originates at `packages/openapi3/src/openapi.ts:592-608`:\n\n```ts\nserviceRecord.versions.push({\n  service,\n  version: snapshot.version!.value,\n  document: document[0],\n  diagnostics: document[1],\n});\n```\n\nIt is interpolated without path validation at `openapi.ts:629-641`:\n\n```ts\nreturn interpolatePath(options.outputFile, {\n  \"openapi-version\": specVersion,\n  \"service-name-if-multiple\": multipleService ? getNamespaceFullName(service.type) : undefined,\n  \"service-name\": getNamespaceFullName(service.type),\n  \"file-type\": fileType,\n  version,\n});\n```\n\nThe path reaches `emitFile()` at `openapi.ts:392-401`. The sink at `packages/compiler/src/core/emitter-utils.ts:29-39` performs no output-root containment check:\n\n```ts\nconst outputFolder = getDirectoryPath(options.path);\nawait program.host.mkdirp(outputFolder);\nreturn await program.host.writeFile(options.path, content);\n```\n\n`resolvePath()` joins the template to `emitterOutputDir` before `{version}` is interpolated, so it does not see the attacker-controlled `..` components.\n\n### Proof of concept\n\nThe relevant input in `poc/main.tsp` is:\n\n```tsp\n@versioned(Versions) namespace Svc;\nenum Versions { v1: \"../../../../../../../../../../tmp/TYPESPEC_PWNED/pwn\" }\n```\n\nRun from PowerShell:\n\n```powershell\ncd poc\n.\\run-revalidation.ps1\n```\n\nThe supplied Docker runner uses a digest-pinned Node base, a committed npm integrity lock, disabled runtime networking, a benign control, a 90-second timeout, and cleanup enforcement.\n\nObserved in the preserved identity-locked replay (`1/1` attack and `1/1` negative control):\n\n```text\nnegative_before=02dc7d056c2f773e56e2c1849947888b039f127ddd630c0bd76a5d7a9ca29cbd\nnegative_after=02dc7d056c2f773e56e2c1849947888b039f127ddd630c0bd76a5d7a9ca29cbd\nattack_before=7a8067bc04e42a025de90fd7aff9be4df59f005d192f2116eecfb107d7bffd78\nattack_after=2992b399c1573c9bd2130794f8554c4026bf425861f74e78b5d89ae0324b5e38\noutside_file_head=openapi: 3.0.0\ninside_attack_files=\n```\n\nThe benign version preserved the outside canary. The crafted version replaced it with emitted OpenAPI content, and no attack output file remained under `tsp-output`.\n\n### Impact and constraints\n\nProven impact is out-of-directory YAML/JSON creation or overwrite. The attacker can influence the traversal, final basename, and many strings in the OpenAPI-structured content. The extension is constrained to the selected emitter format, content is not arbitrary bytes, and the target must be writable.\n\nThis report demonstrates file corruption. Denial of service is a potential impact when a writable critical file is targeted. It does not claim file disclosure, arbitrary-byte write, deployment takeover, or code execution by a downstream consumer.\n\n### Suggested remediation\n\nAfter every filename token has been interpolated, resolve the completed destination against `emitterOutputDir` and reject any non-descendant using path-component-aware comparison. Reject or slugify absolute paths, path separators, and traversal components in spec-derived filename tokens. Add regression cases for POSIX and Windows separators, absolute values, sibling-prefix paths, and benign semantic versions.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree","id":"GHSA-2q42-4q24-7rgv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["1.15.0"],"package":"@typespec/compiler","purl":null,"source":"GHSA-2q42-4q24-7rgv"},{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["1.15.0"],"package":"@typespec/compiler","purl":"pkg:npm/%40typespec/compiler","source":"GHSA-2q42-4q24-7rgv"},{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["1.15.0"],"package":"@typespec/openapi3","purl":null,"source":"GHSA-2q42-4q24-7rgv"},{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["1.15.0"],"package":"@typespec/openapi3","purl":"pkg:npm/%40typespec/openapi3","source":"GHSA-2q42-4q24-7rgv"}],"products":null,"published":"2026-09-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A path traversal vulnerability in the TypeSpec OpenAPI3 emitter allows attackers to overwrite files outside the output directory via crafted version strings.","url":"https://insights.sbomify.com/GHSA-2q42-4q24-7rgv/"}