High severity · published Oct 29, 2026
CVE-2026-119028
oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
New
8.8
CVSS
–
EPSS
No
On KEV
Description
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
oapi-codegen · oapi-codegen
2.0.0 before 2.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119028
github.com
https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12
github.com
https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16
github.com
https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1
github.com
https://github.com/oapi-codegen/oapi-codegen/pull/2626
github.com
https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1
github.com
https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc
More from oapi-codegen
7.5
CVE-2026-119027
oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension