CVE Browser

Page 1

oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

CVE ID	Description	Severity	CVSS	EPSS	Ecosystems	Published
CVE-2026-53507	oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs	HIGH	8.3	0.50%		Aug 31, 2026
CVE-2026-53508	oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)	MEDIUM	6.0	0.50%	Go	Aug 31, 2026

Rows per page

Showing 1 to 2 CVEs · page 1