oapi-codegen vulnerabilities
CVEs whose affected-version data names the oapi-codegen package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-119027High· 7.5oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an Open…
▾ Twilightoapi-codegen · oapi-codegenEPSS 0.39%via CVEORG
CVE-2026-119028High· 8.8oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can c…
▾ Twilightoapi-codegen · oapi-codegenEPSS 0.42%via CVEORG