The vulnerability stems from oasdiff’s failure to honor the --allow-external-refs=false flag when a specification is loaded from a git revision. Consequently, external $ref URLs are resolved even when the option is explicitly disabled, exposing the host to outbound requests, arbitrary file reads, or injection of untrusted content into the parsed document.

The issue affects oasdiff versions 1.13.2 through 1.18.0. Any user running these releases via the command line or as a Go library is susceptible until the software is updated beyond 1.18.0.

With a CVSS score of 6.0 the flaw is considered moderate and is listed as not in the CISA KEV catalog. Although EPSS data is unavailable, the attack requires an attacker to control the repository or the git revision reference supplied to oasdiff. By hosting a malicious git repository containing $ref entries that point to external services or local file paths, an attacker can induce the tool to perform SSRF or read sensitive files from the machine executing oasdiff.