DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-2Q42-4Q24-7RGV: Path Traversal Vulnerability in Microsoft TypeSpec Core and Emitter Packages

#security #cve #cybersecurity #ghsa

Path Traversal Vulnerability in Microsoft TypeSpec Core and Emitter Packages

Vulnerability ID: GHSA-2Q42-4Q24-7RGV
CVSS Score: 7.9
Published: 2026-09-08

A path traversal vulnerability (CWE-22) in the Microsoft TypeSpec compiler core and associated emitter packages permits unvalidated user input to escape the designated output directory, resulting in arbitrary JSON and YAML file creation or modification on the host system.

TL;DR

Unsanitized path interpolation in Microsoft TypeSpec allows malicious specs to write files outside of the emitterOutputDir via directory traversal sequences.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Local (via malicious TypeSpec file compilation)
  • CVSS Score: 7.9 (Estimated)
  • EPSS Score: N/A
  • Impact: Arbitrary file creation and write outside of output directory
  • Exploit Status: Proof of Concept Available
  • KEV Status: Not Listed

Affected Systems

  • Microsoft TypeSpec compiler toolchain
  • Continuous integration pipelines running legacy @typespec packages
  • Local developer environments executing untrusted TypeSpec specifications
  • @typespec/compiler: < fixed release containing PR #11777 (Fixed in: Fixed in release containing PR #11777)
  • @typespec/openapi3: < fixed release containing PR #11777 (Fixed in: Fixed in release containing PR #11777)
  • @typespec/json-schema: < fixed release containing PR #11777 (Fixed in: Fixed in release containing PR #11777)
  • @typespec/asset-emitter: < fixed release containing PR #11777 (Fixed in: Fixed in release containing PR #11777)

Code Analysis

Commit: e0f67bd

Fix path traversal issues inside the compiler core and emitters

Mitigation Strategies

  • Upgrade Microsoft TypeSpec dependencies to versions incorporating the PR #11777 fix.
  • Execute the TypeSpec compiler within containerized or sandboxed environments.
  • Apply low-privilege execution parameters to build pipelines.

Remediation Steps:

  1. Review package.json and lockfiles to locate instances of @typespec/compiler, @typespec/openapi3, @typespec/json-schema, and @typespec/asset-emitter.
  2. Update all TypeSpec packages to the latest available releases containing the fix from PR #11777.
  3. Configure automated build steps to execute the compiler as a non-privileged user with read-only access to system paths.

References

Read the full report for GHSA-2Q42-4Q24-7RGV on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)