Go/github.com/oasdiff/oasdiff CVE-2026-53508: medium 6, EPSS 0.50%
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff
Action: Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.
go get github.com/oasdiff/oasdiff@v1.18.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.13.2 | 1.18.1 | - |
Fixed versions
| 1.18.1 |
Sources
- osv: GO-2026-5937
- nvd: CVE-2026-53508
- https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9
- https://github.com/oasdiff/oasdiff/pull/832
- https://github.com/oasdiff/oasdiff/pull/974
- https://github.com/oasdiff/oasdiff/pull/975
CVE-2026-53508 · published · modified · JSON