AIKIDO-2026-749753

TL;DR

exact-mirror compiles a value-mirroring function from a TypeBox/OpenAPI schema by building JavaScript source and passing it to Function. Schema property names are embedded directly into that generated source, and before the fix non-identifier names were inserted as raw, unescaped string literals via encodeProperty and joinProperty. A property name containing a quote, backtick, or other special character can break out of the literal and inject attacker-controlled JavaScript into the generated function, which executes when the mirror is compiled or invoked. The fix detects safe identifiers with a strict regex and escapes property names with JSON.stringify using bracket access.