Vulnerabilities

TI-2026-38581 CVE-2026-53507

oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

LOW 37

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00496 Published 2026-08-31 Fixed in 0.0.51 CWE-1188

TI-2026-38582 CVE-2026-53508 · GHSA-2jcc-mxv7-p3f9

LOW 27

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.005 Published 2026-08-31 Fixed in 1.18.1 CWE-693