{"action":"Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.","affected":[{"fixed":"1.18.1","introduced":"1.13.2"}],"component":"github.com/oasdiff/oasdiff","cve_ids":["CVE-2026-53508"],"ecosystem":"Go","epss":0.005,"exploited":false,"fixed_versions":["1.18.1"],"ghsa_id":"GHSA-2jcc-mxv7-p3f9","id":"tcs_01M5KES9Z7SCRA2GPVVH6W1ZFA","modified_at":"2026-07-21T19:19:21.916904551Z","published_at":"2026-07-07T23:45:05Z","references":["https://osv.dev/vulnerability/GHSA-2jcc-mxv7-p3f9","https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9","https://github.com/oasdiff/oasdiff/pull/832","https://github.com/oasdiff/oasdiff/pull/974","https://github.com/oasdiff/oasdiff/pull/975","https://github.com/oasdiff/oasdiff"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2jcc-mxv7-p3f9","url":"https://osv.dev/vulnerability/GHSA-2jcc-mxv7-p3f9"}],"summary":"oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)"}