CVE-2026-119028: oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects using oapi-codegen versions 2.0.0 through before 2.8.1 are exposed if they generate code from an OpenAPI document controlled by an attacker. The risk materializes when the generated Go package is built and imported.
What must an attacker control to exploit it?
The attacker must be able to supply or modify an OpenAPI document processed by oapi-codegen. They can use a non-literal enum entry in an integer, number, or boolean schema to terminate the generated const block and inject a Go init function.
How can I determine whether a project may be affected?
Check whether the project uses an oapi-codegen release from 2.0.0 to before 2.8.1 and whether its OpenAPI inputs can be attacker-controlled. Inspect integer, number, and boolean enum values in those inputs for non-literal entries, especially if generated code was subsequently built and imported.
What is the available remediation?
Upgrade oapi-codegen to version 2.8.1 or later. Until then, do not generate code from untrusted OpenAPI documents and validate that enum entries for integer, number, and boolean schemas are literal values before generation.