oasdiff
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| oasdiff | 1 | – | Aug 31, 2026 |
| oasdiff-action | 1 | – | Aug 31, 2026 |
Exploited and recent CVEs
- CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs 0.5%
- CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) 0.5%