AIKIDO-2026-671328

TL;DR

The export path in mapshaper uses a layer's name directly as the output file basename in assignUniqueLayerNames. Because layer names are derived from input data (for example a TopoJSON object key), a crafted input file can supply a name containing path separators, a NULL byte, or a Windows drive prefix, causing output files to be written outside the intended output directory. This allows arbitrary file write or overwrite when a victim converts an untrusted file. The fix rejects layer names that resolve to unsafe filenames before any file is written.