Skip to content
OpenAdvisories

Package · Go

oras.land/oras-go/v2

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-85732

    oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and R…

    oras-project oras-go k8sgpt kubevela-vela-core Debian Ubuntu Wolfi Go
  • Medium 6.9
    CVE-2026-50162

    oras-go: file store write outside workingDir via symlink traversal

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-con…

    oras-project oras-go kubescape kots Debian Ubuntu Wolfi Go
  • Medium —
    GHSA-vh4v-2xq2-g5cg

    ORAS Go forwards registry credentials across registry redirects

    # ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU ## Summary ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects. There are two re…

    oras.land/oras-go/v2 Go