The oasdiff-action GitHub Action is vulnerable to SSRF and unauthorized file disclosure due to insecure default handling of external references, posing a significant risk to CI/CD pipeline security.

This vulnerability involves the insecure default configuration of the action to resolve external references, which allows an unauthenticated attacker to force the runner to perform unauthorized requests and access local files.

The exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive environment variables, secrets, or configuration files stored on the GitHub runner. Given the CVSS score of 8.3, this flaw presents a high risk to the integrity and confidentiality of the entire CI/CD pipeline, potentially facilitating further attacks against the broader infrastructure.

Immediate Action: Update oasdiff-action to version 0.0.51 or later to disable the insecure default behavior.

Proactive Monitoring: Review GitHub Action execution logs for suspicious network activity or unexpected requests originating from the runner environment during pull request processing.

Compensating Controls: If immediate patching is not possible, restrict the use of this action to trusted repositories and disable external reference resolution in the action configuration if supported.

Public Exploit Available: Unknown

This vulnerability represents a high-severity risk to development environments. Security teams should prioritize updating to version 0.0.51 immediately to prevent unauthorized access to runner resources. Organizations should also audit their CI/CD workflows to ensure that third-party actions are pinned to secure versions and that internal policies restrict the execution of untrusted code on shared runners.