CVE-2026-119028
Received Received - Intake

Code Injection in oapi-codegen via OpenAPI Enum Manipulation

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119028
EUVD
EUVD-2026-112756

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oapi-codegen oapi-codegen 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119028 is a code injection vulnerability in oapi-codegen versions 2.0.0 to 2.8.0. It allows attackers to inject Go code by crafting non-literal enum entries in integer, number, or boolean schemas. The injected code executes when the generated Go package is built and imported, potentially leading to arbitrary code execution.

Detection Guidance

To detect this vulnerability, inspect OpenAPI specifications for non-literal enum values in integer, number, or boolean schemas. Check generated Go code for injected func init() blocks in constants.tmpl output. Review build logs for unexpected code execution during package imports.

Impact Analysis

If you use oapi-codegen to generate Go code from OpenAPI specifications, an attacker could craft a malicious specification that injects code into the generated package. This code runs automatically when the package is imported or built, potentially allowing the attacker to execute arbitrary commands on your system.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially compromising data confidentiality and integrity. For GDPR, it may violate principles of data protection by design and default. For HIPAA, it could result in unauthorized access to protected health information. Compliance may be impacted if the vulnerability leads to data breaches or unauthorized system access.

Mitigation Strategies

Upgrade oapi-codegen to version 2.8.1 or later. Avoid using untrusted OpenAPI specifications. Review and rebuild all generated Go code from specifications. Restrict remote reference fetching during code generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart