{"id":"GO-2026-6016","revision":"9c8cfae7256c482bbbd7bfa8ade286f9","records":[{"revision":"9c8cfae7256c482bbbd7bfa8ade286f9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6016","aliases":["GHSA-rjwr-m7qx-3fjr"],"title":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen","description":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-25T03:29:37.7434736+00:00","affected":[{"ecosystem":"Go","name":"github.com/oapi-codegen/oapi-codegen","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/oapi-codegen/oapi-codegen/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6","https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6016","license":"OSV · upstream source license applies","key":"osv:GO-2026-6016","identifiers":["GO-2026-6016","GHSA-rjwr-m7qx-3fjr"]},"retained":false,"historicalAffected":[]}],"coverage":[]}