CVE-2026-119027
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
Risk Assessment
An attacker could execute arbitrary Go code in the context of the victim's application, potentially leading to system compromise or data theft.
Recommendation
Update oapi-codegen to version 2.8.1 or later to eliminate the vulnerability.
Other vulnerabilities in oapi-codegen
Original NVD description (English source)
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS