Read the docs

oapi-codegen

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

oapi-codegen records in CISA KEV

No oapi-codegen vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-82376 CVE-2026-119028 · GHSA-qf68-jmvg-6fww

Code injection in oapi-codegen via non-string enum values

Priority MEDIUM 40

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00422 Published 2026-10-29 Fixed in 2.8.1 CWE-94
TI-2026-82375 CVE-2026-119027 · GHSA-prxp-239m-mh9f

Code injection in oapi-codegen via servers x-go-name extension

Priority LOW 36

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00394 Published 2026-10-29 Fixed in 2.8.1 CWE-94
Open these records in search →