Unrated

oasdiff external $ref policy bypass on git-revision load path

IdentifiersCVE-2026-53508CWE-918

CVE-2026-53508 affects github.com/oasdiff/oasdiff. The vulnerability is a policy-enforcement bypass in the git-revision input/load path (rev:path): oasdiff does not correctly enforce the --allow-external-refs=false setting when loading OpenAPI specifications through that path. As a result, external $ref targets can still be resolved even though external references were explicitly disabled. In practice, when oasdiff processes an untrusted OpenAPI document via the git-revision load path, an attacker can embed external $ref values pointing to HTTP(S) resources or local filesystem paths, including file:// URIs, and cause the tool to dereference them. This creates an SSRF and local file read condition despite the intended safeguard.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker controlling or influencing an OpenAPI specification processed by oasdiff via the git-revision path to force outbound requests to attacker-chosen or internal HTTP(S) endpoints and to trigger reads of local files through path-based or file:// references. The primary impacts are server-side request forgery against internal or external network targets and unintended disclosure of local file contents accessible to the oasdiff process. Depending on deployment context, this may expose sensitive configuration, credentials, metadata services, or other internal resources.

Mitigation

If you can’t patch tonight, do this now.

Until the fixed version is deployed, avoid using the git-revision input form (rev:path) for untrusted OpenAPI specifications when external references are intended to be disabled. As additional defensive measures, only process trusted specs, restrict outbound network access from the environment running oasdiff, and limit filesystem access available to the process to reduce SSRF and local file disclosure exposure.

Remediation

Patch, then assume compromise.

Upgrade github.com/oasdiff/oasdiff to version 1.18.1 or later. The fixed release enforces the external reference policy on the git-revision load path and blocks external $ref resolution when --allow-external-refs=false is set.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity