What’s Vulnerable › Vulnerabilities

CVE-2026-53508: oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

• Severity: medium (CVSS 6.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-09
• Weakness: CWE-73

Description

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

Affected products

• oasdiff: from 1.13.2, < 1.18.1

References

• https://github.com/oasdiff/oasdiff/pull/832
• https://github.com/oasdiff/oasdiff/pull/974
• https://github.com/oasdiff/oasdiff/pull/975
• https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9

Get alerted when CVE-2026-53508 or the next vulnerability affects your stack