Live › vulnerability › CVE-2026-119028
oapi-codegen 2.0.0 before 2.8.1 fails to validate non-literal enum entries in integer, number, or boolean schemas, so Go code can be injected into generated output. An attacker who controls an OpenAPI document can run code when the generated package is built and imported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Teams that run oapi-codegen to generate Go code from OpenAPI documents, especially when those documents come from outside the team. Exposure depends on the generator reading untrusted schemas; teams that only generate from their own reviewed specs have lower risk, but the fix still applies. Teams not using oapi-codegen 2.0.0 through 2.8.0 can skip it.
No product ranges from the sources yet.
oapi-codegen --version or in go.mod for github.com/oapi-codegen/oapi-codegen/v2.2.8.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
This page as .md · .json · in your agent: get_signal("CVE-2026-119028")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.