{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/oapi-codegen/oapi-codegen","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rjwr-m7qx-3fjr","id":"tcs_01M5KGRAAFCE399X5XEMGE7N7W","modified_at":"2026-07-25T03:29:37.743473573Z","published_at":"2026-07-22T20:36:35Z","references":["https://osv.dev/vulnerability/GO-2026-6016","https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6","https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6016","url":"https://osv.dev/vulnerability/GO-2026-6016"}],"summary":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen"}