Description
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
oapi-codegen oapi-codegen
Default version status: unaffected
2.0.0 to < 2.8.1affected
pkg:golang/github.com/oapi-codegen/oapi-codegen/v2References
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc ↗
- https://github.com/oapi-codegen/oapi-codegen/pull/2626 ↗
- https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1 ↗
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16 ↗
- https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12 ↗
- https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1 ↗
- https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2 ↗
- https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values ↗