GHSA-2q42-4q24-7rgv: OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as {version} without sanitizing path separators or traversal components. The completed path reaches the compiler’s emitFile(), which creates the parent directory and writes the file without verifying containment under emitterOutputDir.

A crafted declarative .tsp input can therefore create or overwrite an OpenAPI-formatted .yaml or .json file outside the configured output tree, subject to the compiler process’s filesystem permissions. No executable TypeSpec extension or attacker-controlled JavaScript is required.