{"action":"Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.","affected":[{"fixed":"1.18.1","introduced":"1.13.2"}],"component":"github.com/oasdiff/oasdiff","cve_ids":["CVE-2026-53508"],"ecosystem":"Go","epss":0.005,"exploited":false,"fixed_versions":["1.18.1"],"ghsa_id":"GHSA-2jcc-mxv7-p3f9","id":"tcs_01M5KGQVSREVZV9VQ5FEA8QKB6","modified_at":"2026-07-21T19:15:26.382846169Z","published_at":"2026-07-17T19:42:05Z","references":["https://osv.dev/vulnerability/GO-2026-5937","https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9","https://github.com/oasdiff/oasdiff/pull/832","https://github.com/oasdiff/oasdiff/pull/974","https://github.com/oasdiff/oasdiff/pull/975"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GO-2026-5937","url":"https://osv.dev/vulnerability/GO-2026-5937"},{"source":"nvd","source_id":"CVE-2026-53508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53508"}],"summary":"oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff"}