Threats affecting pkg:golang/oapi-codegen

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

oapi-codegen versions 2.5.0 through 2.8.0 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code via the servers[].x-go-name field, which is emitted unescaped in the server-urls template. The injected code can include a func init() that executes when the victim builds and imports the generated package. The vulnerability is fixed in version 2.8.1.