Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119027

oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Oapi-codegen
Products
Oapi-codegen
CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Oapi-codegen
Products
Oapi-codegen