oapi-codegen code injection via OpenAPI server description

Executive brief

oapi-codegen is a tool used by developers to automatically generate Go code from OpenAPI specifications. A vulnerability exists where a maliciously crafted OpenAPI file can inject hidden executable code into the generated files. If a developer or automated system uses a compromised specification, it could lead to unauthorized code execution on developer machines or within production environments.

Technical details

A code injection vulnerability exists in oapi-codegen due to improper neutralization of newlines in the 'servers[].description' field of OpenAPI documents. The tool inserts this description directly into Go line comments in the generated source code via the 'server-urls.tmpl' template. An attacker can provide a description containing newlines followed by arbitrary Go code; because the template does not escape these newlines, the injected code 'breaks out' of the comment and becomes executable. The vulnerability is further facilitated by the tool's use of 'goimports', which automatically formats the injected code into valid Go declarations. This can result in build-time or runtime code execution when the generated package is imported or executed. The issue is fixed in version 2.7.1.

Affected products

• oapi-codegen oapi-codegen/v2 <= 2.7.0

Timeline

• 2026-06-05: patched: Fix released in version 2.7.1
• 2026-07-17: disclosed: Advisory published on GitHub

References

• https://api.github.com/users/quart27219
• https://github.com/quart27219
• https://api.github.com/users/quart27219/gists%7B/gist_id%7D
• https://api.github.com/users/quart27219/repos
• https://avatars.githubusercontent.com/u/251948304?v=4
• https://api.github.com/users/quart27219/events%7B/privacy%7D