GHSA-rjwr-m7qx-3fjr

## Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI `summary` text is embedded into generated TypeScript MCP server source without proper escaping. `oapi-codegen` has a similar vulnerability in its server URL generator: untrusted OpenAPI `servers[].description` text is inserted into a generated Go line comment without normalizing embedded newlines. A crafted description can break out of the comment, add imports through `goimports`, and emit executable Go declarations into the generated package. > [!NOTE] > A vulnerability like this requires that it is missed in code review **and** that you then call the malicious method. > > Using an `init()` function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any `oapi-codegen` generated code is executed. > > We **strongly recommend** all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code. > > This is also why we recommend `oapi-codegen` generated code is committed to source control. ## Details The vulnerable sink is in `pkg/codegen/templates/server-urls.tmpl`. ```gotemplate // {{ .GoName }} defines the Server URL for {{ if len .OAPISchema.Description }}{{ .OAPISchema.Description }}{{ else }}{{ .OAPISchema.URL }}{{ end }} const {{ .GoName}} = "{{ .OAPISchema.URL }}" ``` This template assumes the OpenAPI server description remains inside a single Go line comment. However, OpenAPI descriptions are attacker-controlled strings and may contain newlines. Once a newline is present, the next line is no longer part of the comment. The same raw description is also used in the function form of server URL generation: ```gotemplate // New{{ .GoName }} constructs the Server URL for {{ .OAPISchema.Description }}, wi