Command-Line Tool Vulnerability in oasdiff by OpenAPI

CVE-2026-53508

What is CVE-2026-53508?

A vulnerability exists in oasdiff, a command-line and Go package used for comparing and detecting breaking changes in OpenAPI specifications. The flaw arises from the failure to enforce restrictions on external references when loading specifications from specific git revisions. As a result, if users opt to disable external references using the --allow-external-refs=false flag, this setting is ignored in certain contexts, allowing unauthorized external references to be accessed and resolved. This oversight can lead to potential security risks, especially when handling sensitive or critical API specifications. A fix has been implemented in version 1.18.1 to address this issue.

References