Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 0, published 17 July 2026.

Which products and versions are affected?

github.com/oapi-codegen/oapi-codegen/v2 (Go) <= 2.7.0; Oapi-Codegen <= 2.7.0.

Is there a fix for This vulnerability?

A patch was published on 2026-06-05: Fix released in version 2.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run github.com/oapi-codegen/oapi-codegen/v2 (Go) or Oapi-Codegen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

oapi-codegen code injection via OpenAPI server description

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-05: Fix released in version 2.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run github.com/oapi-codegen/oapi-codegen/v2 (Go) or Oapi-Codegen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 0 · Published 2026-07-17

oapi-codegen is a tool used by developers to automatically generate Go code from OpenAPI specifications. A vulnerability exists where a maliciously crafted OpenAPI file can inject hidden executable code into the generated files. If a developer or automated system uses a compromised specification, it could lead to unauthorized code execution on developer machines or within production environments.

Technologies: Oapi-Codegen. Vendors: Go, Oapi-Codegen.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 0, published 17 July 2026.
Which products and versions are affected?: github.com/oapi-codegen/oapi-codegen/v2 (Go) <= 2.7.0; Oapi-Codegen <= 2.7.0.
Is there a fix for This vulnerability?: A patch was published on 2026-06-05: Fix released in version 2.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run github.com/oapi-codegen/oapi-codegen/v2 (Go) or Oapi-Codegen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in oapi-codegen due to improper neutralization of newlines in the 'servers[].description' field of OpenAPI documents. The tool inserts this description directly into Go line comments in the generated source code via the 'server-urls.tmpl' template. An attacker can provide a description containing newlines followed by arbitrary Go code; because the template does not escape these newlines, the injected code 'breaks out' of the comment and becomes executable. The vulnerability is further facilitated by the tool's use of 'goimports', which automatically formats the injected code into valid Go declarations. This can result in build-time or runtime code execution when the generated package is imported or executed. The issue is fixed in version 2.7.1.

Affected products

oapi-codegen oapi-codegen/v2 <= 2.7.0

Timeline

2026-06-05: patched: Fix released in version 2.7.1
2026-07-17: disclosed: Advisory published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.