https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:10:04.400130+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-362107 EUVD-2026-362107 2026-10-06T04:10:04.418982+00:00 EUVD-2026-362107 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53508 fkie_cve-2026-53508 2026-10-06T04:10:04.419018+00:00

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

 https://cve.radiocsirt.org/vuln/ghsa-2jcc-mxv7-p3f9 GHSA-2jcc-mxv7-p3f9 — oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) 2026-10-06T04:10:04.419053+00:00

Affected: Go: github.com/oasdiff/oasdiff

## Summary

From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `openapi3.Loader.IsExternalRefsAllowed = false`) when loading a spec from a **git revision** (the `rev:path` form, e.g. `main:openapi.yaml`). External `$ref`s were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.

## Impact

A caller who set `--allow-external-refs=false` *specifically to safely process untrusted specs* remained exposed — on the git-revision load path only — to:

- **SSRF** via `$ref: "http://<internal-host>/…"`, and - **Local file reads** via `$ref: "/path"` or `file://`.

Affected callers:

- **CLI:** `oasdiff diff main:openapi.yaml HEAD:openapi.yaml --allow-external-refs=false` (and `breaking` / `changelog` / `summary`, and the `git-diff-driver`) run over untrusted spec content. - **Go library consumers** of `github.com/oasdiff/oasdiff/load` that set `IsExternalRefsAllowed = false` and load from a git-revision source via `load.NewSpecInfo`.

The file and URL load paths correctly enforced the setting; only the git-revision path was affected. Callers that left external refs at the default (`true`) are not in scope for *this* advisory.

## Patches

**v1.18.1** enforces the external-refs policy on the git-revision path (so `--allow-external-refs=false` now blocks external `$ref`s there) and returns a dedicated exit code (`123`) when an external `$ref` is refused.

## Workar…