Skip to content
OpenAdvisories

Package · crates.io

ocipkg

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    RUSTSEC-2026-0450

    `ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)

    When `ocipkg` unpacks an OCI archive, the destination directory is derived from the image name, which `ocipkg` reads from the archive's **own** `index.json` (`org.opencontainers.image.ref.name`). That name is attacker-controlled, and `ImageName::parse` accept…

    ocipkg crates.io