{"id":"CVE-2026-53508","title":"oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs","summary":"oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRef…","severity":"medium","cwe":["CWE-73","CWE-693","CWE-918"],"vendor":"oasdiff","product":"github.com/oasdiff/oasdiff","affected":["github.com/oasdiff/oasdiff >= 1.13.2, <= 1.18.0"],"patched":["github.com/oasdiff/oasdiff 1.18.1"],"published":"2026-08-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53508","references":[{"url":"https://github.com/oasdiff/oasdiff/pull/832","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff/pull/974","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff/pull/975","label":"security-advisories@github.com"},{"url":"https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-2jcc-mxv7-p3f9"}],"tags":["nvd","ghsa","go"],"epss":0.00288,"epssPercentile":0.21558,"aliases":["GHSA-2jcc-mxv7-p3f9"],"ecosystem":"go","ingestedAt":"2026-07-08T00:44:25.701Z","slug":"CVE-2026-53508","body":"## Overview\n\noasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53508)\n\nAffected packages:\n\n- `github.com/oasdiff/oasdiff >= 1.13.2, <= 1.18.0`\n\nPatched in:\n\n- `github.com/oasdiff/oasdiff 1.18.1`\n\nSource: https://github.com/advisories/GHSA-2jcc-mxv7-p3f9","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}