Skip to content
OpenAdvisories

Package · crates.io

ocipkg

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Unscored —
    RUSTSEC-2026-0449

    `ocipkg` is unmaintained

    The author of `ocipkg` has archived the repository and declared the crate no longer maintained. [Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release. "No further updates, including security fixes, are planned." ## Alternati…

    ocipkg crates.io
  • High 7.1
    RUSTSEC-2026-0450

    `ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)

    When `ocipkg` unpacks an OCI archive, the destination directory is derived from the image name, which `ocipkg` reads from the archive's **own** `index.json` (`org.opencontainers.image.ref.name`). That name is attacker-controlled, and `ImageName::parse` accept…

    ocipkg crates.io