Vulnerabilities

Vulnerability · GHSA-rjwr-m7qx-3fjr

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Published Jul 17, 2026 · catalog updated Oct 30, 2026 · oapi-codegen: OpenAPI Server Description

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-rjwr-m7qx-3fjr. A missing EPSS score is not a low risk. Compare oapi-codegen: OpenAPI Server Description with the linked advisory before you change production.

Severity

None0.0

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

Go github.com/oapi-codegen/oapi-codegen/v2

## Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI text is embedded into generated TypeScript MCP server source without proper escaping. has a similar vulnerability in its server URL generator: untrusted OpenAPI text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through , and emit executable Go declarations into the generated package. > [!NOTE] > A vulnerability like this requires that it is missed in code review **and** that you then call the malicious method. > > Using an function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any generated code is executed. > > We **strongly recommend** all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code. > > This is also why we recommend generated code is committed to source control. ## Details The vulnerable sink is in . This template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment. The same raw description is also used in the function form of server URL generation: Identifier generation does not protect this sink. In , the description is normalized only for the generated Go identifier: The identifier is sanitized, but the raw is still rendered in the comment template. This leaves the code-generation context vulnerable. The generated file is then formatted with in : only removes byte-order marks: It does not escape comments, replace newlines, or otherwise serialize untrusted text for a Go source-code context. As a re