GHSA-rjwr-m7qx-3fjr: oapi-codegen OpenAPI Server Description Escapes Generated Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rjwr-m7qx-3fjr",
  "modified" : "2026-07-17T18:50:17Z",
  "published" : "2026-07-17T18:50:17Z",
  "aliases" : [ ],
  "summary" : "oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code",
  "details" : "## Summary\n\nThe vulnerability in oapi-codegen seems to be similar with CVE-2026-22785,  which is a generated-code injection issue where untrusted OpenAPI `summary` text is embedded into generated TypeScript MCP server source without proper escaping. `oapi-codegen` has a similar vulnerability in its server URL generator: untrusted OpenAPI `servers[].description` text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through `goimports`, and emit executable Go declarations into the generated package.\n\n> [!NOTE]\n> A vulnerability like this requires that it is missed in code review **and** that you then call the malicious method.\n> \n> Using an `init()` function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any `oapi-codegen` generated code is executed.\n> \n> We **strongly recommend** all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.\n>\n> This is also why we recommend `oapi-codegen` generated code is committed to source control.\n\n## Details\nThe vulnerable sink is in `pkg/codegen/templates/server-urls.tmpl`.\n\n```gotemplate\n// {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }}\nconst {{ .GoName}} = \"{{ .OAPISchema.URL }}\"\n```\n\nThis template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment.\n\nThe same raw description is also used in the function form of server URL generation:\n\n```gotemplate\n// New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, with the provided variables.\nfunc New{{ .GoName }}({{ .NewServerFunctionParams }}) (string, error) {\n```\n\nIdentifier generation does not protect this sink. In `pkg/codegen/server_urls.go`, the description is normalized only for the generated Go identifier:\n\n```go\nsuffix := server.Description\nif suffix == \"\" {\n\tsuffix = nameNormalizer(server.URL)\n}\nname = serverURLPrefix + UppercaseFirstCharacter(suffix)\nname = nameNormalizer(name)\n```\n\nThe identifier is sanitized, but the raw `server.Description` is still rendered in the comment template. This leaves the code-generation context vulnerable.\n\nThe generated file is then formatted with `goimports` in `pkg/codegen/codegen.go`:\n\n```go\ngoCode := SanitizeCode(buf.String())\n\noutBytes, err := imports.Process(opts.PackageName+\".go\", []byte(goCode), nil)\n```\n\n`SanitizeCode` only removes byte-order marks:\n\n```go\nfunc SanitizeCode(goCode string) string {\n\treturn strings.ReplaceAll(goCode, \"\\uFEFF\", \"\")\n}\n```\n\nIt does not escape comments, replace newlines, or otherwise serialize untrusted text for a Go source-code context. As a result, attacker-controlled source can be preserved and formatted as valid Go.\n\n### How to Reproduce\nThe attacker-controlled input is an OpenAPI document whose `servers[].description` contains a newline followed by Go declarations:\n\n```yaml\nopenapi: \"3.0.0\"\ninfo:\n  title: oapi-codegen server URL description injection\n  version: \"1.0.0\"\nservers:\n  - url: https://api.example.com\n    description: |\n      benign\n      var _ = func() int {\n          panic(\"oapi-codegen generated-code execution\")\n          return 0\n      }()\n      //\npaths: {}\n```\n\nGenerate Go source with server URL generation enabled. No special local path or helper file is required for the vulnerability; the malicious description is copied into the generated source-code context.\n\nThe generated source contains attacker-controlled executable code:\n\n```go\n// ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 defines the Server URL for benign\nvar _ = func() int {\n\tpanic(\"oapi-codegen generated-code execution\")\n\treturn 0\n}()\n\n//\n\nconst ServerUrlBenignvarFuncIntPanicOapiCodegenGeneratedCodeExecutionReturn0 = \"https://api.example.com\"\n```\n\n## Impact\n\nAn attacker who can supply or influence an OpenAPI document consumed by `oapi-codegen` can inject arbitrary Go source into the generated package. In common API-client/server generation workflows, this can lead to build-time or runtime code execution in developer machines, CI systems, or downstream applications that trust generated code.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/oapi-codegen/oapi-codegen/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.7.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.7.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/oapi-codegen/oapi-codegen"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-74" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-17T18:50:17Z",
    "nvd_published_at" : null
  }
}