# CVE-2026-119028: oapi-codegen code injection in enum constant generation

Source: https://junglewise.ai/threats/cve-2026-119028-oapi-codegen-2-0-0-before-2-8-1-contains-a-code-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119028 · Severity: high · CVSS 8.8 · Published 2026-10-29

oapi-codegen is a tool that generates Go code from OpenAPI documents. Attackers can craft malicious OpenAPI files with specially-crafted enum values to inject arbitrary Go code, which executes when the generated code is compiled and imported into a project. This allows remote code execution during the build process.

Technologies: [Oapi-Codegen](https://junglewise.ai/threats/technologies/oapi-codegen). Vendors: [Oapi-Codegen](https://junglewise.ai/threats/vendors/oapi-codegen).

## Quick answers

**Is CVE-2026-119028 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119028 being exploited in the wild.

**How severe is CVE-2026-119028?** High severity, with a CVSS score of 8.8, published 29 October 2026.

**Which products and versions are affected?** Oapi-Codegen 2.0.0 before 2.8.1.

**Is there a fix for CVE-2026-119028?** Yes: fixed in 2.8.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119028 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119028?** Check whether you run Oapi-Codegen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.8.1

## Technical details

The vulnerability is a template injection in constants.tmpl where unsanitized enum values from an OpenAPI document are directly embedded into generated Go const blocks. An attacker controlling an OpenAPI input can inject non-literal enum entries that close the const block and define a func init() to execute arbitrary code at import time. The fix in v2.8.1 applies proper string escaping (toGoString filter) to enum values.

## Affected products

- oapi-codegen oapi-codegen 2.0.0 before 2.8.1

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl](https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl)
- [https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl](https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl)

## Related threats

- [oapi-codegen code injection in server URL template](https://junglewise.ai/threats/cve-2026-119027-oapi-codegen-2-5-0-before-2-8-1-contains-a-code-injection)
- [oapi-codegen code injection via OpenAPI server description](https://junglewise.ai/threats/oapi-codegen-code-injection-via-openapi-server-description-302b468f)