{"action":"Upgrade github.com/oapi-codegen/oapi-codegen/v2 to 2.7.1 or later.","affected":[{"fixed":"2.7.1","introduced":"0"}],"component":"github.com/oapi-codegen/oapi-codegen/v2","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["2.7.1"],"ghsa_id":"GHSA-rjwr-m7qx-3fjr","id":"tcs_01M5KFMW7X0FTDTH47DJHCSQEE","modified_at":"2026-09-10T03:51:12.019437167Z","published_at":"2026-07-17T18:50:17Z","references":["https://osv.dev/vulnerability/GHSA-rjwr-m7qx-3fjr","https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6","https://github.com/oapi-codegen/oapi-codegen","https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-rjwr-m7qx-3fjr","url":"https://osv.dev/vulnerability/GHSA-rjwr-m7qx-3fjr"}],"summary":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code"}