Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53507— oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

Quick assessment

Affected
oasdiff oasdiff-action
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 GitHub Action，用于检测 OpenAPI 规范中的破坏性变更，并在每个 Pull Request 上发布代码审查意见。在 0.0.51 版本之前， 动作默认会解析 OpenAPI 规范中的外部 （即 ）。当该动作运行在由攻击者可控的规范的 Pull Request 上时（尤其是公共仓库中的 fork 分支 Pull Request），规范中的 会在运行器（runner）上被获取/读取，且无需任何交互，从而可能导致 SSRF（服务端请求伪造）以及泄露运行器上的结构化文件。该问题已在 0.0.51

CVSS 8.3 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
oasdiff oasdiff-action < 0.0.51 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53507

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
Source: CVE Program / CVE List V5
Vulnerability Description
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
oasdiff oasdiff-action < 0.0.51 -

II. Public POCs for CVE-2026-53507

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53507

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53507 (2)

Vendor Advisories for CVE-2026-53507 (1)

IV. Related Vulnerabilities

Same vendor: oasdiff
Same weakness: CWE-200

V. Comments for CVE-2026-53507

No comments yet

Leave a comment