CVE-2026-53508

Name of the Vulnerable Software and Affected Versions oasdiff versions 1.13.2 through 1.18.0

Description When loading a specification from a git revision (using the rev:path format), the software fails to enforce the --allow-external-refs=false setting (specifically the openapi3.Loader.IsExternalRefsAllowed = false library setting). This allows external $ref resolutions even when they are explicitly disabled, potentially leading to Server-Side Request Forgery (SSRF) via http:// references and local file reads via file:// or absolute paths. This issue affects the CLI when using diff, breaking, changelog, summary, or the git-diff-driver on untrusted content, as well as Go library consumers using load.NewSpecInfo with the git-revision source.

Recommendations Update to version 1.18.1. Avoid using the git-revision input form when processing untrusted specifications with external references disabled.