CVE-2026-53507
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.29%
- CWE
- CWE-200, CWE-918, CWE-1188
- Published
- 2026-08-31
- Last modified
- 2026-09-01
Affected products
- oasdiff oasdiff-action
Weakness type
Related vulnerabilities
- CVE-2026-86767 — Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
- CVE-2026-87810 — Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
- CVE-2026-87032 — Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-87035 — Tanium addressed an information disclosure vulnerability in Comply.
- CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87437 — Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87477 — Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak...