{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119027", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-29T11:32:04.895Z", "datePublished": "2026-10-29T11:36:34.029Z", "dateUpdated": "2026-10-29T17:20:19.252Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T11:36:34.029Z"}, "datePublic": "2026-10-24T00:00:00.000Z", "title": "oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension", "descriptions": [{"lang": "en", "value": "oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "oapi-codegen", "product": "oapi-codegen", "defaultStatus": "unaffected", "versions": [{"version": "2.5.0", "lessThan": "2.8.1", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626", "tags": ["patch", "issue-tracking"], "name": "Pull Request #2626"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1", "tags": ["release-notes"], "name": "oapi-codegen v2.8.1 Release Notes"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr", "tags": ["related", "vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rjwr-m7qx-3fjr)"}, {"name": "VulnCheck Advisory: oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension"}], "credits": [{"lang": "en", "value": "Zachariah Mithani (AploSec)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:37:44.678832Z", "id": "CVE-2026-119027", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:20:19.252Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119027", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T15:37:44.678832Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:37:45.666Z"}}], "cna": {"title": "oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension", "credits": [{"lang": "en", "type": "finder", "value": "Zachariah Mithani (AploSec)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "oapi-codegen", "product": "oapi-codegen", "versions": [{"status": "affected", "version": "2.5.0", "lessThan": "2.8.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2", "defaultStatus": "unaffected"}], "datePublic": "2026-10-24T00:00:00.000Z", "references": [{"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc", "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626", "name": "Pull Request #2626", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1", "name": "oapi-codegen v2.8.1 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr", "name": "GitHub Security Advisory (GHSA-rjwr-m7qx-3fjr)", "tags": ["related", "vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension", "name": "VulnCheck Advisory: oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T11:36:34.029Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119027", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:20:19.252Z", "dateReserved": "2026-10-29T11:32:04.895Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-29T11:36:34.029Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2", "product": "oapi-codegen", "vendor": "oapi-codegen", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package."}], "id": "CVE-2026-119027", "lastModified": "2026-10-29T18:17:29.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119027", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:37:44.678832Z", "version": "2.0.3"}}]}, "published": "2026-10-29T12:17:12.167", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI specification", "id": "2563339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563339"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.", "A flaw was found in oapi-codegen. An attacker who supplies a crafted OpenAPI specification can achieve arbitrary code execution on systems that build or run the generated code. The vulnerability exists because server configuration properties are emitted unescaped into Go code templates, allowing malicious Go code to be injected into the generated output. When a victim imports or compiles the generated package, the injected code automatically executes."], "name": "CVE-2026-119027", "public_date": "2026-10-29T11:36:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119027\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119027\nhttps://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5\nhttps://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7\nhttps://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1\nhttps://github.com/oapi-codegen/oapi-codegen/pull/2626\nhttps://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1\nhttps://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc\nhttps://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr\nhttps://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension"], "statement": "This vulnerability is rated as Important severity because successful exploitation can result in arbitrary code execution within developer systems or automated CI/CD pipelines. An attacker must persuade a user or pipeline to process a crafted OpenAPI definition, but once the compromised Go code is produced, malicious routines execute automatically upon compilation or import. In Red Hat environments, oapi-codegen functions as an offline development utility rather than an exposed network daemon, restricting the attack vector to build-time workflows that consume untrusted third-party schemas.", "threat_severity": "Important"}