{"id":"GO-2026-6016","aliases":["GHSA-rjwr-m7qx-3fjr"],"title":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen","summary":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen","severity":"none","vendor":"oapi-codegen","product":"github.com/oapi-codegen/oapi-codegen","ecosystem":"go","affected":["github.com/oapi-codegen/oapi-codegen","github.com/oapi-codegen/oapi-codegen/v2 < 2.7.1"],"patched":["github.com/oapi-codegen/oapi-codegen/v2 2.7.1"],"published":"2026-07-22","updated":"2026-07-22","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6016","references":[{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr"},{"url":"https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6"},{"url":"https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"}],"tags":["osv","go"],"ingestedAt":"2026-07-23T19:05:54.443Z","slug":"GO-2026-6016","body":"## Overview\n\noapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen\n\n## Affected packages\n\n- `github.com/oapi-codegen/oapi-codegen`\n- `github.com/oapi-codegen/oapi-codegen/v2 < 2.7.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/oapi-codegen/oapi-codegen/v2 2.7.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}