CVE-2026-119028

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119028", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-29T11:32:05.290Z", "datePublished": "2026-10-29T11:36:34.692Z", "dateUpdated": "2026-10-29T14:08:24.785Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T11:36:34.692Z"}, "datePublic": "2026-10-24T00:00:00.000Z", "title": "oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values", "descriptions": [{"lang": "en", "value": "oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "oapi-codegen", "product": "oapi-codegen", "defaultStatus": "unaffected", "versions": [{"version": "2.0.0", "lessThan": "2.8.1", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626", "tags": ["patch", "issue-tracking"], "name": "Pull Request #2626"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1", "tags": ["release-notes"], "name": "oapi-codegen v2.8.1 Release Notes"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2", "tags": ["related", "vendor-advisory"], "name": "GitHub Security Advisory (GHSA-xrqw-w576-xgj2)"}, {"name": "VulnCheck Advisory: oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values"}], "credits": [{"lang": "en", "value": "Zachariah Mithani (AploSec)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T14:08:08.391763Z", "id": "CVE-2026-119028", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T14:08:24.785Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119028", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-29T11:32:05.290Z", "datePublished": "2026-10-29T11:36:34.692Z", "dateUpdated": "2026-10-29T14:08:24.785Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T11:36:34.692Z"}, "datePublic": "2026-10-24T00:00:00.000Z", "title": "oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values", "descriptions": [{"lang": "en", "value": "oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "oapi-codegen", "product": "oapi-codegen", "defaultStatus": "unaffected", "versions": [{"version": "2.0.0", "lessThan": "2.8.1", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-g2vv-83pm-v2hc)"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626", "tags": ["patch", "issue-tracking"], "name": "Pull Request #2626"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12", "tags": ["technical-description"]}, {"url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1", "tags": ["release-notes"], "name": "oapi-codegen v2.8.1 Release Notes"}, {"url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2", "tags": ["related", "vendor-advisory"], "name": "GitHub Security Advisory (GHSA-xrqw-w576-xgj2)"}, {"name": "VulnCheck Advisory: oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values"}], "credits": [{"lang": "en", "value": "Zachariah Mithani (AploSec)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119028", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T14:08:08.391763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T14:08:15.499Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/oapi-codegen/oapi-codegen/v2", "product": "oapi-codegen", "vendor": "oapi-codegen", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported."}], "id": "CVE-2026-119028", "lastModified": "2026-10-29T16:19:37.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119028", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T14:08:08.391763Z", "version": "2.0.3"}}]}, "published": "2026-10-29T12:17:12.310", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/pull/2626"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI enum entries", "id": "2563340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563340"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.", "A flaw was found in oapi-codegen. This vulnerability allows an attacker who controls an OpenAPI specification to achieve arbitrary code execution by supplying crafted enum entries in integer, number, or boolean schemas. When processing the untrusted specification, the generator fails to sanitize these values, allowing injected code to execute when the generated Go package is built or imported."], "name": "CVE-2026-119028", "public_date": "2026-10-29T11:36:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119028\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119028\nhttps://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12\nhttps://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16\nhttps://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1\nhttps://github.com/oapi-codegen/oapi-codegen/pull/2626\nhttps://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1\nhttps://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc\nhttps://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2\nhttps://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values"], "statement": "This vulnerability is rated as an Important severity flaw because successful exploitation allows arbitrary code execution with the privileges of the local user or build environment compiling the generated code. Because oapi-codegen is primarily utilized as a build-time code generator rather than an exposed runtime service, exploitation requires an attacker to induce a developer or automated build pipeline to ingest a malicious OpenAPI specification. Consequently, production workloads are not directly exposed over the network unless untrusted API definitions are dynamically consumed during build or deployment processes.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oapi-codegen", "source": "cna", "vendor": "oapi-codegen"}, "product": "oapi-codegen", "vendor": "oapi-codegen"}], "created": "2026-10-29T12:45:09.818180+00:00", "updated": "2026-10-30T23:14:48.527026+00:00", "vendors": ["oapi-codegen", "oapi-codegen$PRODUCT$oapi-codegen"]}