GHSA-rjwr-m7qx-3fjr: oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server URL generator: untrusted OpenAPI servers[].description text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through goimports, and emit executable Go declarations into the generated package. [!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method. Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed. We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code. This is also why we recommend oapi-codegen generated code is committed to source control. Details The vulnerable sink is in pkg/codegen/templates/server-urls.tmpl. // {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }} const {{ .GoName}} = "{{ .OAPISchema.URL }}" This template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment. The same raw description is also used in the function form of server URL generation: // New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, with the provided variables. func New{{ .GoName }}({{ .NewServerFunctionParams }