CVE-2026-53508
6
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce –allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| oasdiff | oasdiff | >= 1.13.2, < 1.18.1 | affected |
Weaknesses
- CWE-73: CWE-73: External Control of File Name or Path
- CWE-693: CWE-693: Protection Mechanism Failure
- CWE-918: CWE-918: Server-Side Request Forgery (SSRF)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9
- https://github.com/oasdiff/oasdiff/pull/832
- https://github.com/oasdiff/oasdiff/pull/974
- https://github.com/oasdiff/oasdiff/pull/975
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.