Update module github.com/oapi-codegen/oapi-codegen/v2 to v2.7.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/oapi-codegen/oapi-codegen/v2	v2.7.0 → v2.7.1

---

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

GHSA-rjwr-m7qx-3fjr

More information

Details

Summary

The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server URL generator: untrusted OpenAPI servers[].description text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through goimports, and emit executable Go declarations into the generated package.

[!NOTE]
A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

Details

The vulnerable sink is in pkg/codegen/templates/server-urls.tmpl.

// {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }}
const {{ .GoName}} = "{{ .OAPISchema.URL }}"

This template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment.

The same raw description is also used in the function form of server URL generation:

// New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, with the provided variables.
func New{{ .GoName }}({{ .NewServerFunctionParams }}) (string, error) {

Identifier generation does not protect this sink. In pkg/codegen/server_urls.go, the description is normalized only for the generated Go identifier:

suffix := server.Description
if suffix == "" {
	suffix = nameNormalizer(server.URL)
}
name = serverURLPrefix + UppercaseFirstCharacter(suffix)
name = nameNormalizer(name)

The identifier is sanitized, but the raw server.Description is still rendered in the comment template. This leaves the code-generation context vulnerable.

The generated file is then formatted with goimports in pkg/codegen/codegen.go:

goCode := SanitizeCode(buf.String())

outBytes, err := imports.Process(opts.PackageName+".go", []byte(goCode), nil)

SanitizeCode only removes byte-order marks:

func SanitizeCode(goCode string) string {
	return strings.ReplaceAll(goCode, "\uFEFF", "")
}

It does not escape comments, replace newlines, or otherwise serialize untrusted text for a Go source-code context. As a result, attacker-controlled source can be preserved and formatted as valid Go.

How to Reproduce

The attacker-controlled input is an OpenAPI document whose servers[].description contains a newline followed by Go declarations:

openapi: "3.0.0"
info:
  title: oapi-codegen server URL description injection
  version: "1.0.0"
servers:
  - url: https://api.example.com
    description: |
      benign
      var _ = func() int {
          panic("oapi-codegen generated-code execution")
          return 0
      }()
      //
paths: {}

Generate Go source with server URL generation enabled. No special local path or helper file is required for the vulnerability; the malicious description is copied into the generated source-code context.

The generated source contains attacker-controlled executable code:

// ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 defines the Server URL for benign
var _ = func() int {
	panic("oapi-codegen generated-code execution")
	return 0
}()

//

const ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 = "https://api.example.com"

Impact

An attacker who can supply or influence an OpenAPI document consumed by oapi-codegen can inject arbitrary Go source into the generated package. In common API-client/server generation workflows, this can lead to build-time or runtime code execution in developer machines, CI systems, or downstream applications that trust generated code.

Severity

• CVSS Score: 0.0 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

References

• https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr
• https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6
• https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1
• https://github.com/advisories/GHSA-rjwr-m7qx-3fjr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

oapi-codegen/oapi-codegen (github.com/oapi-codegen/oapi-codegen/v2)

v2.7.1: Security fix for Go code injection

Compare Source

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE]
A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.