CyberRota Analysis
AI-GeneratedThe oasdiff tool, versions 1.13.2 to 1.18.0, is vulnerable due to improper enforcement of external reference handling when loading OpenAPI specifications from git revisions, potentially allowing unauthorized external references to be resolved despite user settings. This could lead to security risks such as exposure to malicious external APIs or data. Organizations utilizing oasdiff for API specification management should prioritize upgrading to version 1.18.1 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.