https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:29:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362107 EUVD-2026-362107 https://cve.radiocsirt.org/vuln/euvd-2026-362107 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53508 <p>oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.</p> <p>oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53508 https://cve.radiocsirt.org/vuln/ghsa-2jcc-mxv7-p3f9 <p><strong>Affected:</strong> Go: github.com/oasdiff/oasdiff</p> <p>## Summary</p> <p>From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `openapi3.Loader.IsExternalRefsAllowed = false`) when loading a spec from a **git revision** (the `rev:path` form, e.g. `main:openapi.yaml`). External `$ref`s were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.</p> <p>## Impact</p> <p>A caller who set `--allow-external-refs=false` *specifically to safely process untrusted specs* remained exposed — on the git-revision load path only — to:</p> <p>- **SSRF** via `$ref: &#34;http://&lt;internal-host&gt;/…&#34;`, and - **Local file reads** via `$ref: &#34;/path&#34;` or `file://`.</p> <p>Affected callers:</p> <p>- **CLI:** `oasdiff diff main:openapi.yaml HEAD:openapi.yaml --allow-external-refs=false` (and `breaking` / `changelog` / `summary`, and the `git-diff-driver`) run over untrusted spec content. - **Go library consumers** of `github.com/oasdiff/oasdiff/load` that set `IsExternalRefsAllowed = false` and load from a git-revision source via `load.NewSpecInfo`.</p> <p>The file and URL load paths correctly enforced the setting; only the git-revision path was affected. Callers that left external refs at the default (`true`) are not in scope for *this* advisory.</p> <p>## Patches</p> <p>**v1.18.1** enforces the external-refs policy on the git-revision path (so `--allow-external-refs=false` now blocks external `$ref`s there) and returns a dedicated exit code (`123`) when an external `$ref` is refused.</p> <p>## Workar…</p> <p><strong>Affected:</strong> Go: github.com/oasdiff/oasdiff</p> <p>## Summary</p> <p>From **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `openapi3.Loader.IsExternalRefsAllowed = false`) when loading a spec from a **git revision** (the `rev:path` form, e.g. `main:openapi.yaml`). External `$ref`s were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.</p> <p>## Impact</p> <p>A caller who set `--allow-external-refs=false` *specifically to safely process untrusted specs* remained exposed — on the git-revision load path only — to:</p> <p>- **SSRF** via `$ref: &#34;http://&lt;internal-host&gt;/…&#34;`, and - **Local file reads** via `$ref: &#34;/path&#34;` or `file://`.</p> <p>Affected callers:</p> <p>- **CLI:** `oasdiff diff main:openapi.yaml HEAD:openapi.yaml --allow-external-refs=false` (and `breaking` / `changelog` / `summary`, and the `git-diff-driver`) run over untrusted spec content. - **Go library consumers** of `github.com/oasdiff/oasdiff/load` that set `IsExternalRefsAllowed = false` and load from a git-revision source via `load.NewSpecInfo`.</p> <p>The file and URL load paths correctly enforced the setting; only the git-revision path was affected. Callers that left external refs at the default (`true`) are not in scope for *this* advisory.</p> <p>## Patches</p> <p>**v1.18.1** enforces the external-refs policy on the git-revision path (so `--allow-external-refs=false` now blocks external `$ref`s there) and returns a dedicated exit code (`123`) when an external `$ref` is refused.</p> <p>## Workar…</p> https://cve.radiocsirt.org/vuln/ghsa-2jcc-mxv7-p3f9