Oras-project vulnerabilities
We track 3 vulnerabilities in Oras-project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Oras-project vulnerabilities
- 8.8 High severity
oras-go: Improper Limitation of a Pathname to a Restricted Directory
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureL
- 7.1 High severity
oras-go: Improper Limitation of a Pathname to a Restricted Directory
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/pay
- 7.5 High severity
oras-go: Server-Side Request Forgery
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the