Junglewise Threat Intelligence
GO-2026-6016 - oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
Severity: info · Published 2026-07-22
Technologies: github.com/oapi-codegen/oapi-codegen/v2 (Go). Vendors: Go.
Executive brief
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
Affected products
- Go github.com/oapi-codegen/oapi-codegen
- Go github.com/oapi-codegen/oapi-codegen/v2