---
id: "CVE-2026-119028"
kind: "vulnerability"
aliases: ["CVE-2026-119028"]
title: "oapi-codegen: crafted OpenAPI enum injects Go code at build time"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "go", "oapi-codegen", "package"]
not_affected_if: ["not-using-oapi-codegen-2.x", "own-reviewed-specs-only"]
published_at: "2026-10-29T12:17:12+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:25:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119028", "first_seen_at": "2026-10-29T12:24:38+00:00"}]
---

# oapi-codegen: crafted OpenAPI enum injects Go code at build time

oapi-codegen 2.0.0 before 2.8.1 fails to validate non-literal enum entries in integer, number, or boolean schemas, so Go code can be injected into generated output. An attacker who controls an OpenAPI document can run code when the generated package is built and imported.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of oapi-codegen, for example with `oapi-codegen --version` or in `go.mod` for `github.com/oapi-codegen/oapi-codegen/v2`.
- Look for the tool in CI build steps that generate code from OpenAPI documents you did not write.

## Fix

- oapi-codegen: move to `2.8.1` or later.

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119028

## From the sources

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_