oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/oapi-codegen/oapi-codegen/pull/2626 patch, issue-tracking
- https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1 patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.7 · oapi-codegenNVD modified 2026-10-29 11:36
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc vendor-advisory
- https://github.com/oapi-codegen/oapi-codegen/pull/2626 patch, issue-tracking
- https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1 patch
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7 technical-description
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5 technical-description
- https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1 release-notes
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr related, vendor-advisory
- https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension third-party-advisory