{"answers":{"affected":"4 open source packages ship an affected version, including github.com/oapi-codegen/oapi-codegen/v2 and github.com/oapi-codegen/oapi-codegen.","exploited":"There is no known exploitation of GHSA-rjwr-m7qx-3fjr in the wild and no public exploit code.","fix":"Upgrade github.com/oapi-codegen/oapi-codegen/v2 to 2.7.1 or later.","what":"GHSA-rjwr-m7qx-3fjr is a code injection vulnerability in github.com/oapi-codegen/oapi-codegen, published on 17 Jul 2026."},"fix_prompt":"Check this codebase for GHSA-rjwr-m7qx-3fjr and fix it if it is affected.\n\nWhat it is: GHSA-rjwr-m7qx-3fjr is a code injection vulnerability in github.com/oapi-codegen/oapi-codegen, published on 17 Jul 2026. \nExploitation: There is no known exploitation of GHSA-rjwr-m7qx-3fjr in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/oapi-codegen/oapi-codegen/v2 (Go): affected all versions; fixed in 2.7.1\n- github.com/oapi-codegen/oapi-codegen/v2 (Go): affected all versions; fixed in 2.7.1\n- github.com/oapi-codegen/oapi-codegen/v2 (Go): affected all versions; fixed in 2.7.1\n- github.com/oapi-codegen/oapi-codegen (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-rjwr-m7qx-3fjr/ (Markdown: https://insights.sbomify.com/GHSA-rjwr-m7qx-3fjr/index.md)","id":"GHSA-rjwr-m7qx-3fjr","markdown":"https://insights.sbomify.com/GHSA-rjwr-m7qx-3fjr/index.md","name":"GHSA-rjwr-m7qx-3fjr","record":{"aliases":["GO-2026-6016"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["code_execution"],"network_reachable":"unknown","non_default_config":false,"product_category":"Go code generator","requires_auth":"none","summary":"Attackers can inject executable Go code via crafted OpenAPI server descriptions, requiring code review before execution.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nThe vulnerability in oapi-codegen seems to be similar with CVE-2026-22785,  which is a generated-code injection issue where untrusted OpenAPI `summary` text is embedded into generated TypeScript MCP server source without proper escaping. `oapi-codegen` has a similar vulnerability in its server URL generator: untrusted OpenAPI `servers[].description` text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through `goimports`, and emit executable Go declarations into the generated package.\n\n\u003e [!NOTE]\n\u003e A vulnerability like this requires that it is missed in code review **and** that you then call the malicious method.\n\u003e \n\u003e Using an `init()` function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any `oapi-codegen` generated code is executed.\n\u003e \n\u003e We **strongly recommend** all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.\n\u003e\n\u003e This is also why we recommend `oapi-codegen` generated code is committed to source control.\n\n## Details\nThe vulnerable sink is in `pkg/codegen/templates/server-urls.tmpl`.\n\n```gotemplate\n// {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }}\nconst {{ .GoName}} = \"{{ .OAPISchema.URL }}\"\n```\n\nThis template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment.\n\nThe same raw description is also used in the function form of server URL generation:\n\n```gotemplate\n// New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, with the provided variables.\nfunc New{{ .GoName }}({{ .NewServerFunctionParams }}) (string, error) {\n```\n\nIdentifier generation does not protect this sink. In `pkg/codegen/server_urls.go`, the description is normalized only for the generated Go identifier:\n\n```go\nsuffix := server.Description\nif suffix == \"\" {\n\tsuffix = nameNormalizer(server.URL)\n}\nname = serverURLPrefix + UppercaseFirstCharacter(suffix)\nname = nameNormalizer(name)\n```\n\nThe identifier is sanitized, but the raw `server.Description` is still rendered in the comment template. This leaves the code-generation context vulnerable.\n\nThe generated file is then formatted with `goimports` in `pkg/codegen/codegen.go`:\n\n```go\ngoCode := SanitizeCode(buf.String())\n\noutBytes, err := imports.Process(opts.PackageName+\".go\", []byte(goCode), nil)\n```\n\n`SanitizeCode` only removes byte-order marks:\n\n```go\nfunc SanitizeCode(goCode string) string {\n\treturn strings.ReplaceAll(goCode, \"\\uFEFF\", \"\")\n}\n```\n\nIt does not escape comments, replace newlines, or otherwise serialize untrusted text for a Go source-code context. As a result, attacker-controlled source can be preserved and formatted as valid Go.\n\n### How to Reproduce\nThe attacker-controlled input is an OpenAPI document whose `servers[].description` contains a newline followed by Go declarations:\n\n```yaml\nopenapi: \"3.0.0\"\ninfo:\n  title: oapi-codegen server URL description injection\n  version: \"1.0.0\"\nservers:\n  - url: https://api.example.com\n    description: |\n      benign\n      var _ = func() int {\n          panic(\"oapi-codegen generated-code execution\")\n          return 0\n      }()\n      //\npaths: {}\n```\n\nGenerate Go source with server URL generation enabled. No special local path or helper file is required for the vulnerability; the malicious description is copied into the generated source-code context.\n\nThe generated source contains attacker-controlled executable code:\n\n```go\n// ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 defines the Server URL for benign\nvar _ = func() int {\n\tpanic(\"oapi-codegen generated-code execution\")\n\treturn 0\n}()\n\n//\n\nconst ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 = \"https://api.example.com\"\n```\n\n## Impact\n\nAn attacker who can supply or influence an OpenAPI document consumed by `oapi-codegen` can inject arbitrary Go source into the generated package. In common API-client/server generation workflows, this can lead to build-time or runtime code execution in developer machines, CI systems, or downstream applications that trust generated code.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code","id":"GHSA-rjwr-m7qx-3fjr","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/oapi-codegen/oapi-codegen","purl":"pkg:golang/github.com/oapi-codegen/oapi-codegen","source":"GO-2026-6016"},{"ecosystem":"Go","fixed":["2.7.1"],"introduced":["0"],"last_affected":[],"package":"github.com/oapi-codegen/oapi-codegen/v2","purl":null,"source":"GHSA-rjwr-m7qx-3fjr"},{"ecosystem":"Go","fixed":["2.7.1"],"introduced":["0"],"last_affected":[],"package":"github.com/oapi-codegen/oapi-codegen/v2","purl":"pkg:golang/github.com/oapi-codegen/oapi-codegen/v2","source":"GHSA-rjwr-m7qx-3fjr"},{"ecosystem":"Go","fixed":["2.7.1"],"introduced":["0"],"last_affected":[],"package":"github.com/oapi-codegen/oapi-codegen/v2","purl":"pkg:golang/github.com/oapi-codegen/oapi-codegen/v2","source":"GO-2026-6016"}],"products":null,"published":"2026-07-17","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject executable Go code via crafted OpenAPI server descriptions, requiring code review before execution.","url":"https://insights.sbomify.com/GHSA-rjwr-m7qx-3fjr/"}