CVE-2026-53507

oasdiff-action, a GitHub Action that flags breaking OpenAPI changes on pull requests, resolved external $refs by default (allow-external-refs: true) in all versions before 0.0.51. When the action runs on a pull request whose spec is attacker-controlled — most notably fork pull requests against public repositories — the action fetches or reads the referenced resource on the runner with no user interaction required. An attacker gains SSRF (causing the runner to make network requests to attacker-specified targets, potentially including internal or metadata endpoints reachable from the runner) and disclosure of structured files on the runner, whose contents can surface in the action's output or PR review. Affected users are any GitHub workflows running oasdiff-action before 0.0.51, with the highest risk on public repositories that accept fork pull requests. There is no known public proof-of-concept, exploitation is not listed in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade oasdiff-action to version 0.0.51 or later, or explicitly set allow-external-refs: false in the workflow as a mitigation. Prioritize public repositories that trigger the action on fork pull requests, and consider reviewing recent workflow runs and rotating any secrets available to affected jobs. With no known exploitation or public PoC, patching can follow normal cycles but should not be deferred for high-risk fork-PR workflows.