Threats tagged 'ghsa-2jcc-mxv7-p3f9'

From versions 1.13.2 through 1.18.0, the oasdiff tool did not enforce the --allow-external-refs=false setting when loading OpenAPI specs from a git revision path. This flaw allowed external references to be resolved even when explicitly disabled, exposing users to server-side request forgery (SSRF) and local file read risks via crafted $ref values. The issue affects CLI commands and Go library consumers using the git-revision load path with external refs disabled. Version 1.18.1 fixes this by enforcing the external refs policy on the git-revision path and returning a dedicated exit code when external refs are blocked.