{"id":"GHSA-rjwr-m7qx-3fjr","aliases":["GO-2026-6016"],"url":"https://o3.security/vulnerability/GHSA-rjwr-m7qx-3fjr","summary":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code","details":"## Summary\n\nThe vulnerability in oapi-codegen seems to be similar with CVE-2026-22785,  which is a generated-code injection issue where untrusted OpenAPI `summary` text is embedded into generated TypeScript MCP server source without proper escaping. `oapi-codegen` has a similar vulnerability in its server URL generator: untrusted OpenAPI `servers[].description` text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through `goimports`, and emit executable Go declarations into the generated package.\n\n> [!NOTE]\n> A vulnerability like this requires that it is missed in code review **and** that you then call the malicious method.\n> \n> Using an `init()` function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any `oapi-codegen` generated code is executed.\n> \n> We **strongly recommend** all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.\n>\n> This is also why we recommend `oapi-codegen` generated code is committed to source control.\n\n## Details\nThe vulnerable sink is in `pkg/codegen/templates/server-urls.tmpl`.\n\n```gotemplate\n// {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }}\nconst {{ .GoName}} = \"{{ .OAPISchema.URL }}\"\n```\n\nThis template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment.\n\nThe same raw description is also used in the function form of server URL generation:\n\n```gotemplate\n// New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, with the provided variables.\nfunc New{{ .GoName }}({{ .NewServerFunctionParams }}) (string, error) {\n```\n\nIdentifier generation does not protect this sink. In `pkg/codegen/server_urls.go`, the description is normalized only for the generated Go identifier:\n\n```go\nsuffix := server.Description\nif suffix == \"\" {\n\tsuffix = nameNormalizer(server.URL)\n}\nname = serverURLPrefix + UppercaseFirstCharacter(suffix)\nname = nameNormalizer(name)\n```\n\nThe identifier is sanitized, but the raw `server.Description` is still rendered in the comment template. This leaves the code-generation context vulnerable.\n\nThe generated file is then formatted with `goimports` in `pkg/codegen/codegen.go`:\n\n```go\ngoCode := SanitizeCode(buf.String())\n\noutBytes, err := imports.Process(opts.PackageName+\".go\", []byte(goCode), nil)\n```\n\n`SanitizeCode` only removes byte-order marks:\n\n```go\nfunc SanitizeCode(goCode string) string {\n\treturn strings.ReplaceAll(goCode, \"\\uFEFF\", \"\")\n}\n```\n\nIt does not escape comments, replace newlines, or otherwise serialize untrusted text for a Go source-code context. As a result, attacker-controlled source can be preserved and formatted as valid Go.\n\n### How to Reproduce\nThe attacker-controlled input is an OpenAPI document whose `servers[].description` contains a newline followed by Go declarations:\n\n```yaml\nopenapi: \"3.0.0\"\ninfo:\n  title: oapi-codegen server URL description injection\n  version: \"1.0.0\"\nservers:\n  - url: https://api.example.com\n    description: |\n      benign\n      var _ = func() int {\n          panic(\"oapi-codegen generated-code execution\")\n          return 0\n      }()\n      //\npaths: {}\n```\n\nGenerate Go source with server URL generation enabled. No special local path or helper file is required for the vulnerability; the malicious description is copied into the generated source-code context.\n\nThe generated source contains attacker-controlled executable code:\n\n```go\n// ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 defines the Server URL for benign\nvar _ = func() int {\n\tpanic(\"oapi-codegen generated-code execution\")\n\treturn 0\n}()\n\n//\n\nconst ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 = \"https://api.example.com\"\n```\n\n## Impact\n\nAn attacker who can supply or influence an OpenAPI document consumed by `oapi-codegen` can inject arbitrary Go source into the generated package. In common API-client/server generation workflows, this can lead to build-time or runtime code execution in developer machines, CI systems, or downstream applications that trust generated code.","published":"2026-07-17T18:50:17Z","modified":"2026-07-22T21:11:48.091503522Z","cvss":{"score":0,"severity":"NONE","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/oapi-codegen/oapi-codegen/v2","fixedVersion":"2.7.1"}],"fix":{"url":"https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6","label":"oapi-codegen/oapi-codegen@19c6282"},"references":[{"type":"WEB","url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr"},{"type":"WEB","url":"https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6"},{"type":"PACKAGE","url":"https://github.com/oapi-codegen/oapi-codegen"},{"type":"WEB","url":"https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-22T21:11:48.091503522Z"}}