Vendor
The @typespec/openapi3 emitter fails to sanitize version-derived path tokens, allowing arbitrary file creation or overwrite outside the intended output directory.