CVE-2026-53508
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.
| CWE | CWE-73 CWE-693 CWE-918 |
| Vendor | oasdiff |
| Product | oasdiff |
| Published | Aug 31, 2026 |
| Last Updated | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for oasdiff oasdiff
Be the first to know when new unknown vulnerabilities affecting oasdiff oasdiff are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
oasdiff / oasdiff
>= 1.13.2, < 1.18.1