{"id":"CVE-2026-119027","aliases":[],"cve":{"records":[{"id":"CVE-2026-119027","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T11:32:04.895Z","published":"2026-10-29T11:36:34.029Z","modified":"2026-10-29T17:20:19.252Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-29T11:36:34.029Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:20:19.252Z"}],"references":[{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/pull/2626","tags":["patch","issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","tags":["related","vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-94","description":"Improper Control of Generation of Code ('Code Injection')","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T15:37:44.678832Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.","score":7.7,"severity":"high","published":"2026-10-29T11:36:34.029Z","modified":"2026-10-29T17:20:19.252Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"oapi-codegen","name":"oapi-codegen","platforms":[],"versions":[{"version":"2.5.0","status":"affected","lessThan":"2.8.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/oapi-codegen/oapi-codegen/v2","packageIdentity":{"ecosystem":"Go","name":"github.com/oapi-codegen/oapi-codegen/v2"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119027"}],"remediation":[],"references":["https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc","https://github.com/oapi-codegen/oapi-codegen/pull/2626","https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1","https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7","https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5","https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1","https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension"],"sources":[{"name":"CVE","id":"CVE-2026-119027","modified":"2026-10-29T17:20:19.252Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119027"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T17:51:57.602Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:40:32.658Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T18:40:36.824Z","attemptedAt":"2026-10-29T18:40:36.824Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T18:40:37.277Z","attemptedAt":"2026-10-29T18:40:37.277Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T18:40:37.766Z","attemptedAt":"2026-10-29T18:40:37.766Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T18:40:36.313Z","attemptedAt":"2026-10-29T18:40:36.313Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119027","modified":"2026-10-29T18:17:29.510","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T18:40:36.824Z"},{"source":"NVD","id":"CVE-2026-119027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119027","modified":"2026-10-29T18:17:29.510","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T18:40:36.824Z"},{"source":"GitHub Advisory Database","id":"GHSA-prxp-239m-mh9f","url":"https://github.com/advisories/GHSA-prxp-239m-mh9f","modified":"2026-10-29T12:30:47Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T18:40:37.277Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112755","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112755","modified":"Oct 29, 2026, 5:20:19 PM","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-29T18:40:37.766Z"}],"aiSummary":{"text":"oapi-codegen versions 2.5.0 before 2.8.1 have a code injection vulnerability via the servers[].x-go-name extension, allowing attackers to inject Go code. Attackers must control an OpenAPI document to exploit this weakness. The impact is code execution when the victim builds and imports the generated package.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:54:42.732Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119027"}]}}