Threats affecting pkg:golang/github.com/oapi-codegen/oapi-codegen

oapi-codegen versions from 2.0.0 up to but not including 2.8.1 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code by supplying non-literal enum entries in integer, number, or boolean schemas. The injected code executes during the build and import of the generated package, potentially leading to full compromise.

oapi-codegen versions from 2.5.0 up to but not including 2.8.1 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code via a crafted servers[].x-go-name value. The injected code executes when the victim builds and imports the generated package, potentially leading to full compromise of confidentiality, integrity, and availability.