oapi-codegen has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.5 (high). Most affected products: oapi-codegen (2), github.com/oapi-codegen/oapi-codegen (1), github.com/oapi-codegen/oapi-codegen/v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 2
Products
- oapi-codegen 2
- github.com/oapi-codegen/oapi-codegen 1
- github.com/oapi-codegen/oapi-codegen/v2 1
Worst active — by depth score
CVE-2026-119028High· 8.8oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values48CVE-2026-119027High· 7.5oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension41GHSA-rjwr-m7qx-3fjrLow· 0.0oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code14GO-2026-6016Noneoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen3
oapi-codegen vulnerabilities
CVEs affecting oapi-codegen, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-119027High· 7.5oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an Open…
CVE-2026-119028High· 8.8oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can c…
GO-2026-6016Noneoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
GHSA-rjwr-m7qx-3fjrLow· 0.0oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code