CVE-2026-119028

37th percentile - higher than 37% of all known CVEs

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

An attacker could execute arbitrary Go code in the context of the victim's application, potentially leading to system compromise or data theft.

Update oapi-codegen to version 2.8.1 or later to eliminate the vulnerability.