---
id: GO-2026-6016
aliases:
  - GHSA-rjwr-m7qx-3fjr
title: >-
  oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and
  Injects Executable Code in github.com/oapi-codegen/oapi-codegen
summary: >-
  oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and
  Injects Executable Code in github.com/oapi-codegen/oapi-codegen
severity: none
vendor: oapi-codegen
product: github.com/oapi-codegen/oapi-codegen
ecosystem: go
affected:
  - github.com/oapi-codegen/oapi-codegen
  - github.com/oapi-codegen/oapi-codegen/v2 < 2.7.1
patched:
  - github.com/oapi-codegen/oapi-codegen/v2 2.7.1
published: '2026-07-22'
updated: '2026-07-22'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6016'
references:
  - url: >-
      https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr
  - url: >-
      https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6
  - url: 'https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1'
tags:
  - osv
  - go
ingestedAt: '2026-07-23T19:05:54.443Z'
---

## Overview

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen

## Affected packages

- `github.com/oapi-codegen/oapi-codegen`
- `github.com/oapi-codegen/oapi-codegen/v2 < 2.7.1`

## Remediation

Upgrade to a patched release:

- `github.com/oapi-codegen/oapi-codegen/v2 2.7.1`