High severity · published Oct 29, 2026
CVE-2026-119027
oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
New
7.5
CVSS
–
EPSS
No
On KEV
Description
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
oapi-codegen · oapi-codegen
2.5.0 before 2.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119027
github.com
https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5
github.com
https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7
github.com
https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1
github.com
https://github.com/oapi-codegen/oapi-codegen/pull/2626
github.com
https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1
github.com
https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc
More from oapi-codegen
8.8
CVE-2026-119028
oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values