oapi-codegen: Code injection via non-string enum values in OpenAPI specs

Summary

oapi-codegen versions 2.0.0 up to 2.8.0 allow code injection through non-literal enum entries in integer, number or boolean schemas of an OpenAPI document. An attacker who controls the OpenAPI document can craft an enum entry that closes the const block in the code template and inserts a func init() function. The injected code runs when the generated package is built and imported, typically on developer machines or CI runners. The NVD rating (CVSS 4.0 8.7) assumes that a user must process the malicious document (UI:P).

Affected

• oapi-codegen 2.0.0 up to but not including 2.8.1
• Packages in downstream distributions may still ship older versions (for example Nixpkgs release-26.05 at 2.5.1, which is in the affected range)

Fixed in

• Version 2.8.1 (vendor advisory GHSA-g2vv-83pm-v2hc)

Workaround

• No vendor-published workaround specific to this CVE. Unknown.
• Only generate code from OpenAPI specifications you control or have reviewed.
• Download remote specifications locally and validate them before running oapi-codegen. This reduces exposure but is not a fix.
• Pin the generator version and do not run code generation on untrusted input in CI pipelines that have access to secrets.

Exploitation

• No public exploit confirmed. VulDB states that no exploit is available.
• No evidence of exploitation in the wild found.
• Unconfirmed: an OffSeq page mentions Metasploit and nuclei content, but this is not clearly linked to this CVE.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Upgrade oapi-codegen to version 2.8.1 or later, including in CI images and developer toolchains.
• Check that generated code and the github.com/oapi-codegen/runtime version are compatible with the new release before upgrading.
• Review which OpenAPI specifications are processed, especially third-party or remotely fetched ones, and validate them before code generation.
• Check distribution packages for older versions and update them separately.
• Priority: moderate for teams that generate code from external specifications, low for teams that only use their own specifications.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-g2vv-83pm-v2hc github.com
• oapi-codegen v2.8.1 release github.com
• Fix commit 068f1bc github.com
• Patch pull request #2626 github.com
• VulnCheck advisory www.vulncheck.com
• Nixpkgs issue on release-26.05 lag github.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:42.