https://feed.craftedsignal.io/products/oapi-codegen-2.5.0-before-2.8.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:37:07 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-oapi-codegen-code-injection/Thu, 29 Oct 2026 15:37:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-oapi-codegen-code-injection/oapi-codegen versions 2.5.0 before 2.8.1 contain a code injection vulnerability allowing attackers to execute Go code via crafted OpenAPI documents.<p>oapi-codegen versions 2.5.0 before 2.8.1 contain a code injection vulnerability. Attackers who control an OpenAPI document can supply a crafted servers[].x-go-name value, which the server-urls template emits unescaped. This allows an attacker to define an injected func init() that executes when the victim builds and imports the generated package.</p> highadvisory