CVE-2026-119028

    Dashboard / Vulnerabilities / CVE-2026-119028

    CVE-2026-119028

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

    Details: oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119028.json, https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1, https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc, https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2, https://nvd.nist.gov/vuln/detail/CVE-2026-119028, https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values, https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1, https://github.com/oapi-codegen/oapi-codegen/pull/2626, https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12, https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ba76f6c927e11747fc4d9547d18b0c0b14a80658
    Fixed -068f1bcd16e4724c72d78d6774008a877b8297b1

    Affected versions

    v2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119028 | CVE-DB