oasdiff git-revision path ignores --allow-external-refs, enabling SSRF/local file read (CVE-2025-52928)

Vulnerability Summary: oasdiff Does Not Enforce (git-revision loading path) Vulnerability Overview CVE ID: CVE-2025-52928 Severity: Moderate Vulnerability Type: SSRF / Local File Read Description: In versions v1.13.2 through v1.18.0, oasdiff does not enforce . When a specification is loaded via a git revision (e.g., ), is not applied, causing external definitions to be resolved, potentially triggering SSRF or local file read vulnerabilities. Scope of Impact Affected Versions: Fixed Version: Impact Scenarios: - When a caller sets to safely handle untrusted specifications, the git-revision loading path still resolves external references. - Attack vectors include: - SSRF: via - Local File Read: via or Affected Callers: - CLI: (along with breaking changes/changelog/summary) - git-diff driver: Running comparisons of untrusted specifications - Go library : Sets and loads from a git-revision source Not Impacted: File and URL loading paths correctly enforce this setting; default values ( ) and zero-configuration exposure in CI are tracked separately under GHSA-R9J7-2972-7V2. Fix Patch: v1.18.1 enforces the external reference policy in the git-revision path ( now blocks external resolutions), and returns a dedicated exit code (123) when an external is reused. Mitigation: - Upgrade to v1.18.1 or later - Avoid processing untrusted specifications via git-revision input while external references are disabled Notes This issue was introduced in v1.13.2 (commit 4832, which added chain resolution for the git-revision path) and fixed in v1.18.1 (commits 9974, 9975).

Goal Reached Thanks to every supporter — we hit 100%!

oasdiff git-revision path ignores --allow-external-refs, enabling SSRF/local file read (CVE-2025-52928)

More from this source