Threats tagged 'ghsa-prxp-239m-mh9f'

oapi-codegen versions from 2.5.0 up to but not including 2.8.1 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code via a crafted servers[].x-go-name value. The injected code executes when the victim builds and imports the generated package, potentially leading to full compromise of confidentiality, integrity, and availability.