---
id: CVE-2026-53508
title: >-
  oasdiff is a command-line and Go package that compares and detects breaking
  changes in OpenAPI specs
summary: >-
  oasdiff is a command-line and Go package that compares and detects breaking
  changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff
  did not enforce --allow-external-refs=false (library:
  openapi3.Loader.IsExternalRef…
severity: medium
cwe:
  - CWE-73
  - CWE-693
  - CWE-918
vendor: oasdiff
product: github.com/oasdiff/oasdiff
affected:
  - 'github.com/oasdiff/oasdiff >= 1.13.2, <= 1.18.0'
patched:
  - github.com/oasdiff/oasdiff 1.18.1
published: '2026-08-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53508'
references:
  - url: 'https://github.com/oasdiff/oasdiff/pull/832'
    label: security-advisories@github.com
  - url: 'https://github.com/oasdiff/oasdiff/pull/974'
    label: security-advisories@github.com
  - url: 'https://github.com/oasdiff/oasdiff/pull/975'
    label: security-advisories@github.com
  - url: 'https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-2jcc-mxv7-p3f9'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00288
epssPercentile: 0.21604
aliases:
  - GHSA-2jcc-mxv7-p3f9
ecosystem: go
ingestedAt: '2026-07-08T00:44:25.701Z'
---

## Overview

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53508)

Affected packages:

- `github.com/oasdiff/oasdiff >= 1.13.2, <= 1.18.0`

Patched in:

- `github.com/oasdiff/oasdiff 1.18.1`

Source: https://github.com/advisories/GHSA-2jcc-mxv7-p3f9