{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.15.0"}],"component":"@typespec/openapi3","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2q42-4q24-7rgv","id":"tcs_01M5KETSSXZCPVCDQ1195V5W9V","modified_at":"2026-09-08T21:45:04.607149521Z","published_at":"2026-09-08T21:31:09Z","references":["https://osv.dev/vulnerability/GHSA-2q42-4q24-7rgv","https://github.com/microsoft/typespec/security/advisories/GHSA-2q42-4q24-7rgv","https://github.com/microsoft/typespec/pull/11777","https://github.com/microsoft/typespec/commit/e0f67bdf3c5a0875dfa98b475648af37caac71a6","https://github.com/microsoft/typespec"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-2q42-4q24-7rgv","url":"https://osv.dev/vulnerability/GHSA-2q42-4q24-7rgv"}],"summary":"OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree"}