Executive brief
oasdiff is a tool used to compare OpenAPI specifications, often used in automated pipelines to detect breaking changes. A vulnerability was found where the security setting to block external references was ignored when loading files from a Git revision (e.g., comparing 'main:api.yaml'). This could allow a malicious specification file to trick the tool into accessing internal network services or reading sensitive local files on the machine running the scan.
Technical details
The vulnerability exists in the `loadFromGitRevision` function within the `github.com/oasdiff/oasdiff/load` package. When a spec is loaded using the `rev:path` syntax, oasdiff installs a custom `ReadFromURIFunc` to handle `git show` operations. However, due to the behavior of the underlying `kin-openapi` library, the presence of a custom loader bypasses the standard `IsExternalRefsAllowed` check. The custom loader in affected versions of oasdiff delegated non-git references (HTTP/file) to the default URI reader without verifying the user's security policy. An attacker providing a malicious OpenAPI spec can use `$ref` to perform Server-Side Request Forgery (SSRF) or read local files. This is fixed in v1.18.1 by explicitly checking the policy within the git-revision load path.
Affected products
- oasdiff oasdiff >= 1.13.2, <= 1.18.0
Timeline
- 2026-04-09: other: Vulnerability introduced in PR #832
- 2026-05-30: patched: Fix merged in PR #974
- 2026-06-01: disclosed
- 2026-07-07: advisory