CVE-2026-119027: oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of oapi-codegen versions 2.5.0 through before 2.8.1 are exposed if they generate code from an OpenAPI document controlled by an attacker and then build and import the generated package.
What does an attacker need to exploit it?
The attacker must be able to supply or modify an OpenAPI document used for generation. They can place crafted Go code in the servers[].x-go-name extension, which is emitted unescaped by the server-urls template.
What can be done if updating is not immediately possible?
Do not generate, build, or import packages generated from untrusted OpenAPI documents. Restrict control of OpenAPI inputs and review servers[].x-go-name values before generation.
How can I identify potentially affected generated code?
Check whether code was generated with an affected oapi-codegen version from an OpenAPI document that was not fully trusted. Inspect generated packages for unexpected injected Go code, including a func init() definition.