AIKIDO-2026-509766

TL;DR

The entity generator derives output file names for native enum and routine source files from database-introspected type and routine names without the identifier escaping applied to entity class names. A name containing ../ is joined onto the configured output directory, so running generation against a schema a third party can write to writes files outside the intended path and can overwrite existing .ts files. Combined with the unescaped-literal flaw in the same package it can place injected executable TypeScript over a file the project already imports. The fix normalizes enum and routine names before using them as file names and confines generated files to the project or configured output directory.