Refine your search

2 vulnerabilities found for oapi-codegen by oapi-codegen

CVE-2026-119028 (GCVE-0-2026-119028)
Vulnerability from cvelistv5
Published
2026-10-29 11:36
Modified
2026-10-29 14:08
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
References
Impacted products
Vendor Product Version
oapi-codegen oapi-codegen Version: 2.0.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:08:08.391763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:08:24.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2",
          "product": "oapi-codegen",
          "vendor": "oapi-codegen",
          "versions": [
            {
              "lessThan": "2.8.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T11:36:34.692Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc"
        },
        {
          "name": "Pull Request #2626",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12"
        },
        {
          "name": "oapi-codegen v2.8.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1"
        },
        {
          "name": "GitHub Security Advisory (GHSA-xrqw-w576-xgj2)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2"
        },
        {
          "name": "VulnCheck Advisory: oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values"
        }
      ],
      "title": "oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119028",
    "datePublished": "2026-10-29T11:36:34.692Z",
    "dateReserved": "2026-10-29T11:32:05.290Z",
    "dateUpdated": "2026-10-29T14:08:24.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119027 (GCVE-0-2026-119027)
Vulnerability from cvelistv5
Published
2026-10-29 11:36
Modified
2026-10-29 11:36
Severity ?
7.7 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
References
Impacted products
Vendor Product Version
oapi-codegen oapi-codegen Version: 2.5.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2",
          "product": "oapi-codegen",
          "vendor": "oapi-codegen",
          "versions": [
            {
              "lessThan": "2.8.1",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T11:36:34.029Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc"
        },
        {
          "name": "Pull Request #2626",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5"
        },
        {
          "name": "oapi-codegen v2.8.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1"
        },
        {
          "name": "GitHub Security Advisory (GHSA-rjwr-m7qx-3fjr)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr"
        },
        {
          "name": "VulnCheck Advisory: oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension"
        }
      ],
      "title": "oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119027",
    "datePublished": "2026-10-29T11:36:34.029Z",
    "dateReserved": "2026-10-29T11:32:04.895Z",
    "dateUpdated": "2026-10-29T11:36:34.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}