{"id":"CVE-2026-119027","kind":"vulnerability","aliases":["CVE-2026-119027"],"related":[],"title":"oapi-codegen: crafted OpenAPI document injects Go code into generated packages","description":"oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.","summary":"oapi-codegen versions 2.5.0 through 2.8.0 emit a server URL name from the x-go-name field without escaping it, so a crafted OpenAPI document can inject Go code. An attacker who controls the spec gets code that runs when the generated package is built and imported.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["code-generation","go","oapi-codegen","package"],"not_affected_if":["trusted-specs-only","version-2.8.1-or-later"],"how_to_check":"- Run `oapi-codegen --version` or check the pinned `github.com/oapi-codegen/oapi-codegen/v2` version in `go.mod`\n- Look for `servers[].x-go-name` in OpenAPI documents fed to the generator, especially ones from third parties","fix":"- Upgrade oapi-codegen to `2.8.1` or later","status":"open","published_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:31+00:00","updated_at":"2026-10-29T12:25:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T12:25:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade oapi-codegen to `2.8.1` or later","reach":"local","title":"oapi-codegen: crafted OpenAPI document injects Go code into generated packages","impact":"high","summary":"oapi-codegen versions 2.5.0 through 2.8.0 emit a server URL name from the x-go-name field without escaping it, so a crafted OpenAPI document can inject Go code. An attacker who controls the spec gets code that runs when the generated package is built and imported.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","oapi-codegen","code-generation"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"code runs in any build or service importing the generated package","analyst_note":"","how_to_check":"- Run `oapi-codegen --version` or check the pinned `github.com/oapi-codegen/oapi-codegen/v2` version in `go.mod`\n- Look for `servers[].x-go-name` in OpenAPI documents fed to the generator, especially ones from third parties","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.8.1-or-later","trusted-specs-only"],"who_is_affected":"Teams that run oapi-codegen 2.5.0 up to but not including 2.8.1 to generate Go code from OpenAPI documents. Exposure needs an attacker to control or influence the OpenAPI document, such as a spec pulled from an untrusted source. Teams that only generate from their own reviewed specs are at much lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4151,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119027':15A,18A '-2026':14A,17A '2.5.0':31B,79C '2.8.0':33B '2.8.1':81C 'allow':88C 'attack':59B,89C,112C 'build':129C 'built':73B 'code':9A,20B,57B,65B,84C,93C 'code-gener':19B 'codegen':3A,25B,29B,78C 'contain':82C 'control':61B,114C 'craft':4A,51B,97C 'cve':13A,16A 'defin':119C 'document':6A,53B,117C 'emit':34B,104C 'escap':47B 'execut':125C 'field':45B 'func':122C 'generat':11A,21B,70B,133C 'get':64B 'go':8A,22B,43B,56B,92C,101C 'import':75B,131C 'init':123C 'inject':7A,55B,85C,91C,121C 'name':38B,44B,102C 'oapi':2A,24B,28B,77C 'oapi-codegen':1A,23B,27B,76C 'openapi':5A,52B,116C 'packag':12A,26B,71B,134C 'run':67B 'server':36B,98C,109C 'server-url':108C 'spec':63B 'suppli':95C 'templat':111C 'unescap':105C 'url':37B,110C 'valu':103C 'version':30B 'victim':128C 'vulner':86C 'without':46B 'x':42B,100C 'x-go-nam':41B,99C","nicknames":[],"mitigations":[],"who_affected":"Teams that run oapi-codegen 2.5.0 up to but not including 2.8.1 to generate Go code from OpenAPI documents. Exposure needs an attacker to control or influence the OpenAPI document, such as a spec pulled from an untrusted source. Teams that only generate from their own reviewed specs are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119027","severity":null,"published_at":"2026-10-29T12:17:12+00:00","modified_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}