Code Injection Vulnerability in oapi-codegen Products by OpenAPI

CVE-2026-119028

What is CVE-2026-119028?

oapi-codegen versions prior to 2.8.1 are vulnerable to code injection through non-literal enum entries in integer, number, or boolean schemas. An attacker with control over an OpenAPI document can exploit this vulnerability by crafting an enum entry that improperly closes the constant block in constants.tmpl. This allows the injection of a 'func init()' function, which executes arbitrary code when the impacted package is built and imported. This vulnerability presents significant risks in environments where oapi-codegen is utilized, enabling potential remote code execution without user consent.

References