Live › vulnerability › CVE-2026-119027
oapi-codegen versions 2.5.0 through 2.8.0 emit a server URL name from the x-go-name field without escaping it, so a crafted OpenAPI document can inject Go code. An attacker who controls the spec gets code that runs when the generated package is built and imported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Teams that run oapi-codegen 2.5.0 up to but not including 2.8.1 to generate Go code from OpenAPI documents. Exposure needs an attacker to control or influence the OpenAPI document, such as a spec pulled from an untrusted source. Teams that only generate from their own reviewed specs are at much lower risk.
No product ranges from the sources yet.
oapi-codegen --version or check the pinned github.com/oapi-codegen/oapi-codegen/v2 version in go.modservers[].x-go-name in OpenAPI documents fed to the generator, especially ones from third parties2.8.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
This page as .md · .json · in your agent: get_signal("CVE-2026-119027")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.