Skip to content
OpenAdvisories

Vendor

oras-project

7 known vulnerabilities.

Products

oras-go 6 oras 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-85731

    oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensure…

    oras-project oras-go k8sgpt k9s Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-50151

    oras-go: credential forwarding via unvalidated Location header in blob upload

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from th…

    oras-project oras-go kubescape kots Debian Ubuntu Wolfi Go
  • High 7.1
    CVE-2026-50163

    oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/pa…

    oras-project oras-go zot kots Debian Ubuntu Wolfi Go