{"id":"CVE-2026-53507","title":"oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request","summary":"oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-r…","severity":"none","cwe":["CWE-200","CWE-918","CWE-1188"],"published":"2026-08-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53507","references":[{"url":"https://github.com/oasdiff/oasdiff-action/pull/128","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff-action/pull/129","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff-action/pull/130","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff-action/security/advisories/GHSA-fhj3-7267-7vv5","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00285,"epssPercentile":0.21332,"ingestedAt":"2026-09-09T21:22:45.561Z","slug":"CVE-2026-53507","body":"## Overview\n\noasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}