Summary
oapi-codegen can emit attacker-controlled Go code when a crafted OpenAPI document supplies a malicious servers[].x-go-name value. If a victim generates, builds, and imports the resulting package, injected code such as an init() function may execute during program startup.
oapi-codegen can emit attacker-controlled Go code when a crafted OpenAPI document supplies a malicious servers[].x-go-name value. If a victim generates, builds, and imports the resulting package, injected code such as an init() function may execute during program startup.
Affected context
The vulnerability occurs in oapi-codegen's server-URLs template when values from an OpenAPI document are inserted into generated Go source without adequate escaping. Risk is highest when an attacker can provide or influence an OpenAPI document that is processed by a code-generation pipeline and the generated package is subsequently compiled and used.
The vulnerability occurs in oapi-codegen's server-URLs template when values from an OpenAPI document are inserted into generated Go source without adequate escaping. Risk is highest when an attacker can provide or influence an OpenAPI document that is processed by a code-generation pipeline and the generated package is subsequently compiled and used.
Exploit preconditions
- Attack surface: OpenAPI document processing and server-URLs code generation
- Required access: Ability to supply or modify an OpenAPI document consumed by oapi-codegen
- Trigger point: Generation followed by compilation and import of the generated Go package
- Why exploitation is possible: The
servers[].x-go-namevalue is emitted as Go source without sufficient escaping, allowing injected code to become part of the generated package
- Attack surface: OpenAPI document processing and server-URLs code generation
- Required access: Ability to supply or modify an OpenAPI document consumed by oapi-codegen
- Trigger point: Generation followed by compilation and import of the generated Go package
- Why exploitation is possible: The
servers[].x-go-namevalue is emitted as Go source without sufficient escaping, allowing injected code to become part of the generated package
Why this happens
The underlying bug is insufficient separation between OpenAPI data and generated Go source code. A template treats a user-controlled extension value as source content rather than as data requiring context-appropriate encoding, allowing attacker-supplied syntax to be emitted into the output. This behavior maps to CWE-94: Improper Control of Generation of Code, because generated code can contain unintended executable constructs.
The underlying bug is insufficient separation between OpenAPI data and generated Go source code. A template treats a user-controlled extension value as source content rather than as data requiring context-appropriate encoding, allowing attacker-supplied syntax to be emitted into the output. This behavior maps to CWE-94: Improper Control of Generation of Code, because generated code can contain unintended executable constructs.
Potential impact
- Execution of attacker-controlled code during builds or application startup
- Compromise of developer workstations, build agents, or CI environments
- Theft of source code, credentials, or build secrets
- Supply-chain contamination of generated packages or downstream applications
- Modification of generated artifacts or application behavior
- Execution of attacker-controlled code during builds or application startup
- Compromise of developer workstations, build agents, or CI environments
- Theft of source code, credentials, or build secrets
- Supply-chain contamination of generated packages or downstream applications
- Modification of generated artifacts or application behavior
General mitigation guidance
Mitigation generally focuses on ensuring that OpenAPI metadata remains data throughout code generation.
Common defensive patterns include:
- Apply context-appropriate escaping or identifier validation before inserting values into Go templates
- Use structured code-generation APIs or typed template helpers instead of concatenating raw source fragments
- Restrict accepted extension values to safe identifier formats where feasible
- Treat externally supplied OpenAPI documents as untrusted inputs and review generated source before compilation
- Isolate generation and build processes with least-privilege permissions and minimal access to secrets
- Require provenance and integrity checks for specifications and generated artifacts
Mitigation generally focuses on ensuring that OpenAPI metadata remains data throughout code generation.
Common defensive patterns include:
- Apply context-appropriate escaping or identifier validation before inserting values into Go templates
- Use structured code-generation APIs or typed template helpers instead of concatenating raw source fragments
- Restrict accepted extension values to safe identifier formats where feasible
- Treat externally supplied OpenAPI documents as untrusted inputs and review generated source before compilation
- Isolate generation and build processes with least-privilege permissions and minimal access to secrets
- Require provenance and integrity checks for specifications and generated artifacts
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis for template expressions that insert untrusted values into source-code contexts
- Code review checks for raw OpenAPI extensions used in generated identifiers or declarations
- Tests that generate code from adversarial metadata and verify that values remain inert data
- CI policies that inspect generated diffs and reject unexpected declarations or executable constructs
- Dependency and source-scanning tools that flag unsafe code-generation patterns
Organizations can detect this class of issue through:
- Static analysis for template expressions that insert untrusted values into source-code contexts
- Code review checks for raw OpenAPI extensions used in generated identifiers or declarations
- Tests that generate code from adversarial metadata and verify that values remain inert data
- CI policies that inspect generated diffs and reject unexpected declarations or executable constructs
- Dependency and source-scanning tools that flag unsafe code-generation patterns
