Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-119028: oapi-codegen may execute attacker code during generation

CVE-2026-119028 · published 2 days ago

Summary

The oapi-codegen tool (versions 2.0.0 through 2.8.0) can run malicious code if it processes an OpenAPI file that contains specially crafted enum values. This could let an attacker cause arbitrary commands to run when the generated Go package is built. Upgrade to version 2.8.1 or later, and only use trusted OpenAPI specifications.

What to do

Update oapi-codegen oapi-codegen to version 2.8.1 or later.

Affected software

Vendor	Product	Affected versions
oapi-codegen	oapi-codegen	< 2.8.1

Original advisory text

oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

References

https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/c... Third Party Advisory
https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/c... Third Party Advisory
https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d677400... Patch
https://github.com/oapi-codegen/oapi-codegen/pull/2626 Patch
https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1 Vendor Advisory
https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-... Vendor Advisory
https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-... Vendor Advisory
https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-inject... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1190... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-119028 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published29 Oct 2026

Updated30 Oct 2026

First seen29 Oct 2026

Sources

CVE-2026-119028 · NVD

CVE-2026-119028 · MITRE

CVE-2026-119028 · OSV

Track software like this

Free during beta