GHSA-2q42-4q24-7rgv

### Summary The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into the output filename as `{version}` without sanitizing path separators or traversal components. The completed path reaches the compiler's `emitFile()`, which creates the parent directory and writes the file without verifying containment under `emitterOutputDir`. A crafted declarative `.tsp` input can therefore create or overwrite an OpenAPI-formatted `.yaml` or `.json` file outside the configured output tree, subject to the compiler process's filesystem permissions. No executable TypeSpec extension or attacker-controlled JavaScript is required. ### Affected version Confirmed on: - `@typespec/compiler` `1.15.0` - `@typespec/openapi3` `1.15.0` - `@typespec/http` `1.15.0` - `@typespec/versioning` `0.85.0` - release tag commit `f30cd352f93997e04c75d48c7ace6947a1d5d07a` The critical `openapi.ts` and `emitter-utils.ts` blobs are unchanged on main commit `365ec52b50b82cd9e1e037de4c6fcd5de7e32e90` as checked on 2026-08-19. No patched version was identified. ### Root cause The value originates at `packages/openapi3/src/openapi.ts:592-608`: ```ts serviceRecord.versions.push({ service, version: snapshot.version!.value, document: document[0], diagnostics: document[1], }); ``` It is interpolated without path validation at `openapi.ts:629-641`: ```ts return interpolatePath(options.outputFile, { "openapi-version": specVersion, "service-name-if-multiple": multipleService ? getNamespaceFullName(service.type) : undefined, "service-name": getNamespaceFullName(service.type), "file-type": fileType, version, }); ``` The path reaches `emitFile()` at `openapi.ts:392-401`. The sink at `packages/compiler/src/core/emitter-utils.ts:29-39` performs no output-root containment check: ```ts const outputFolder = getDirectoryPath(options.path); await program.host.mkdirp(outputFolder); return await program.host.writeFile(options.path, content); ``` `reso