Code Injection Vulnerability in oapi-codegen by OAPI Codegen

CVE-2026-119027

What is CVE-2026-119027?

A code injection vulnerability exists in oapi-codegen versions prior to 2.8.1. This flaw allows malicious actors to inject Go code by crafting the 'servers[].x-go-name' value, which is emitted unescaped by the 'server-urls' template. If an attacker can control an OpenAPI document, they have the potential to define an injected 'func init()', which will execute automatically when a victim imports the generated package. Users are advised to upgrade to the latest version to mitigate this risk.

References