---
id: CVE-2026-53507
title: >-
  oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI
  specs and post a review on every pull request
summary: >-
  oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI
  specs and post a review on every pull request. Before version 0.0.51, the
  oasdiff actions resolved external $refs in the OpenAPI spec by default
  (allow-external-r…
severity: none
cwe:
  - CWE-200
  - CWE-918
  - CWE-1188
published: '2026-08-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53507'
references:
  - url: 'https://github.com/oasdiff/oasdiff-action/pull/128'
    label: security-advisories@github.com
  - url: 'https://github.com/oasdiff/oasdiff-action/pull/129'
    label: security-advisories@github.com
  - url: 'https://github.com/oasdiff/oasdiff-action/pull/130'
    label: security-advisories@github.com
  - url: >-
      https://github.com/oasdiff/oasdiff-action/security/advisories/GHSA-fhj3-7267-7vv5
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00496
epssPercentile: 0.40108
ingestedAt: '2026-09-09T21:22:45.561Z'
---

## Overview

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.