Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-119027: oapi-codegen may run attacker code during build

CVE-2026-119027 · published 5 days ago

Summary

Versions of oapi-codegen before 2.8.1 let a crafted OpenAPI document insert Go code that is not escaped. When a developer generates code from such a document and then builds it, the injected code runs automatically. Upgrade to version 2.8.1 or later and only use trusted OpenAPI specifications.

What to do

Update oapi-codegen oapi-codegen to version 2.8.1 or later.

Affected software

Vendor	Product	Affected versions
oapi-codegen	oapi-codegen	< 2.8.1

Original advisory text

oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.

References

https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-... Vendor Advisory
https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/s... Third Party Advisory
https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/s... Third Party Advisory
https://github.com/oapi-codegen/oapi-codegen/pull/2626 Patch
https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1 Vendor Advisory
https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-inject... Vendor Advisory
https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d677400... Patch
https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1190... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-119027 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published29 Oct 2026

Updated30 Oct 2026

First seen29 Oct 2026

Sources

CVE-2026-119027 · NVD

CVE-2026-119027 · MITRE

CVE-2026-119027 · OSV

Track software like this

Free during beta