{"id":"CVE-2026-119028","kind":"vulnerability","aliases":["CVE-2026-119028"],"related":[],"title":"oapi-codegen: crafted OpenAPI enum injects Go code at build time","description":"oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.","summary":"oapi-codegen 2.0.0 before 2.8.1 fails to validate non-literal enum entries in integer, number, or boolean schemas, so Go code can be injected into generated output. An attacker who controls an OpenAPI document can run code when the generated package is built and imported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","go","oapi-codegen","package"],"not_affected_if":["not-using-oapi-codegen-2.x","own-reviewed-specs-only"],"how_to_check":"- Check the installed version of oapi-codegen, for example with `oapi-codegen --version` or in `go.mod` for `github.com/oapi-codegen/oapi-codegen/v2`.\n- Look for the tool in CI build steps that generate code from OpenAPI documents you did not write.","fix":"- oapi-codegen: move to `2.8.1` or later.","status":"open","published_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:27+00:00","updated_at":"2026-10-29T12:25:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T12:25:27Z","model":"claude-haiku-5-5","output":{"fix":"- oapi-codegen: move to `2.8.1` or later.","reach":"unknown","title":"oapi-codegen: crafted OpenAPI enum injects Go code at build time","impact":"high","summary":"oapi-codegen 2.0.0 before 2.8.1 fails to validate non-literal enum entries in integer, number, or boolean schemas, so Go code can be injected into generated output. An attacker who controls an OpenAPI document can run code when the generated package is built and imported.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","oapi-codegen","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"code runs when the generated package is built","analyst_note":"","how_to_check":"- Check the installed version of oapi-codegen, for example with `oapi-codegen --version` or in `go.mod` for `github.com/oapi-codegen/oapi-codegen/v2`.\n- Look for the tool in CI build steps that generate code from OpenAPI documents you did not write.","plain_action":"","needs_analyst":false,"not_affected_if":["own-reviewed-specs-only","not-using-oapi-codegen-2.x"],"who_is_affected":"Teams that run oapi-codegen to generate Go code from OpenAPI documents, especially when those documents come from outside the team. Exposure depends on the generator reading untrusted schemas; teams that only generate from their own reviewed specs have lower risk, but the fix still applies. Teams not using oapi-codegen 2.0.0 through 2.8.0 can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4164,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119028':15A,18A '-2026':14A,17A '2.0.0':28B,75C '2.8.1':30B,77C 'allow':84C 'attack':55B,85C,103C 'block':117C 'boolean':43B,101C 'build':11A 'built':69B,132C 'ci':19B 'close':114C 'code':9A,47B,63B,80C,89C,126C 'codegen':3A,23B,27B,74C 'const':116C 'constants.tmpl':119C 'contain':78C 'control':57B,104C 'craft':4A,109C 'cve':13A,16A 'document':60B,107C 'entri':38B,96C,112C 'enum':6A,37B,95C,111C 'execut':125C 'fail':31B 'func':123C 'generat':52B,66B,129C 'go':8A,20B,46B,88C 'import':71B,134C 'init':124C 'inject':7A,50B,81C,87C,121C 'integ':40B,98C 'liter':36B,94C 'non':35B,93C 'non-liter':34B,92C 'number':41B,99C 'oapi':2A,22B,26B,73C 'oapi-codegen':1A,21B,25B,72C 'openapi':5A,59B,106C 'output':53B 'packag':24B,67B,130C 'run':62B 'schema':44B,102C 'suppli':91C 'time':12A 'valid':33B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run oapi-codegen to generate Go code from OpenAPI documents, especially when those documents come from outside the team. Exposure depends on the generator reading untrusted schemas; teams that only generate from their own reviewed specs have lower risk, but the fix still applies. Teams not using oapi-codegen 2.0.0 through 2.8.0 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119028","severity":null,"published_at":"2026-10-29T12:17:12+00:00","modified_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}