oapi-codegen: Code injection via crafted OpenAPI documents (CVE-2026-119027)
oapi-codegen versions 2.5.0 before 2.8.1 contain a code injection vulnerability allowing attackers to execute Go code via crafted OpenAPI documents.
CVE search metadata
CVE search record: CVE-2026-119027. Severity: high. CVSS: 7.5. KEV: no. Product: oapi-codegen (2.5.0 before 2.8.1). Brief: oapi-codegen: Code injection via crafted OpenAPI documents (CVE-2026-119027). Brief link: https://feed.craftedsignal.io/briefs/2026-10-oapi-codegen-code-injection/
Triage facts
Revision 1- Applicability
- oapi-codegen (2.5.0 before 2.8.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 15:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
oapi-codegen versions 2.5.0 before 2.8.1 contain a code injection vulnerability. Attackers who control an OpenAPI document can supply a crafted servers[].x-go-name value, which the server-urls template emits unescaped. This allows an attacker to define an injected func init() that executes when the victim builds and imports the generated package.