CVE-2026-119027

    Dashboard / Vulnerabilities / CVE-2026-119027

    CVE-2026-119027

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

    Details: oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119027.json, https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1, https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc, https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr, https://nvd.nist.gov/vuln/detail/CVE-2026-119027, https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension, https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1, https://github.com/oapi-codegen/oapi-codegen/pull/2626, https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5, https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 13eea66b2bf673f56fc270af5699830187d01daf
    Fixed -068f1bcd16e4724c72d78d6774008a877b8297b1

    Affected versions

    v2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119027 | CVE-DB