Search
Find a vulnerability
Search criteria
2 vulnerabilities found for oasdiff by oasdiff
CVE-2026-53508 (GCVE-0-2026-53508)
Vulnerability from nvd – Published: 2026-08-31 18:52 – Updated: 2026-08-31 18:58
VLAI
EPSS
VEX
Title
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
Summary
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:57 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/oasdiff/oasdiff/security/advis… | x_refsource_CONFIRM |
| https://github.com/oasdiff/oasdiff/pull/832 | x_refsource_MISC |
| https://github.com/oasdiff/oasdiff/pull/974 | x_refsource_MISC |
| https://github.com/oasdiff/oasdiff/pull/975 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:57:49.502659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:58:08.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "oasdiff",
"vendor": "oasdiff",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.13.2, \u003c 1.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:52:12.213Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/832",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/832"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/974",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/974"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/975",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/975"
}
],
"source": {
"advisory": "GHSA-2jcc-mxv7-p3f9",
"discovery": "UNKNOWN"
},
"title": "oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53508",
"datePublished": "2026-08-31T18:52:12.213Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-08-31T18:58:08.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53508 (GCVE-0-2026-53508)
Vulnerability from cvelistv5 – Published: 2026-08-31 18:52 – Updated: 2026-08-31 18:58
VLAI
EPSS
VEX
Title
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
Summary
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:57 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/oasdiff/oasdiff/security/advis… | x_refsource_CONFIRM |
| https://github.com/oasdiff/oasdiff/pull/832 | x_refsource_MISC |
| https://github.com/oasdiff/oasdiff/pull/974 | x_refsource_MISC |
| https://github.com/oasdiff/oasdiff/pull/975 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:57:49.502659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:58:08.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "oasdiff",
"vendor": "oasdiff",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.13.2, \u003c 1.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:52:12.213Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/832",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/832"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/974",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/974"
},
{
"name": "https://github.com/oasdiff/oasdiff/pull/975",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oasdiff/oasdiff/pull/975"
}
],
"source": {
"advisory": "GHSA-2jcc-mxv7-p3f9",
"discovery": "UNKNOWN"
},
"title": "oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53508",
"datePublished": "2026-08-31T18:52:12.213Z",
"dateReserved": "2026-06-09T17:05:25.059Z",
"dateUpdated": "2026-08-31T18:58:08.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}