CVE-2026-119027
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to…
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim buil…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.8.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7
- https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1
- https://github.com/oapi-codegen/oapi-codegen/pull/2626
- https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr
- https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension
Original description
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
Last activity 29 Oct 2026. Patch Forecast updates every hour.