{"action":"Upgrade github.com/oapi-codegen/oapi-codegen/v2 to 2.7.1 or later.","affected":[{"fixed":"2.7.1","introduced":"0"}],"component":"github.com/oapi-codegen/oapi-codegen/v2","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["2.7.1"],"ghsa_id":"GHSA-rjwr-m7qx-3fjr","id":"tcs_01M5KGRADR6JCAD633FGP9PVNH","modified_at":"2026-07-25T03:29:37.743473573Z","published_at":"2026-07-22T20:36:35Z","references":["https://osv.dev/vulnerability/GO-2026-6016","https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","https://github.com/oapi-codegen/oapi-codegen/commit/19c6282e9a6fb84b51aa92b12fad1f0b7e5f5ef6","https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.7.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6016#Go/github.com/oapi-codegen/oapi-codegen/v2","url":"https://osv.dev/vulnerability/GO-2026-6016"}],"summary":"oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen"}