CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119028?
CVE-2026-119028 is a high-severity vulnerability in oapi-codegen, published on 29 Oct 2026.
Official description
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
Weakness: CWE-94
Which versions are affected by CVE-2026-119028?
How do I fix CVE-2026-119028?
No fix has been published for CVE-2026-119028 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119028 being exploited?
There is no known exploitation of CVE-2026-119028 in the wild and no public exploit code.
Sources
Also known as GHSA-qf68-jmvg-6fww.