Vulnerabilities

TI-2026-58829 CVE-2026-85731 · GHSA-m37j-52j7-pjw7

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

HIGH 73

oras-go is a Go library for managing OCI artifacts.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00676 Published 2026-09-16 Partial fix · 2.6.2 CWE-22

TI-2026-58830 CVE-2026-85732 · GHSA-h7vf-4x9w-h99v

MEDIUM 55

oras-go is a Go library for managing OCI artifacts.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00384 Published 2026-09-16 Partial fix · 2.6.2 CWE-918

TI-2026-40126 CVE-2026-55588 · GHSA-298f-872v-2rcx

LOW 30

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00538 Published 2026-08-25 Fixed in 1.3.3 CWE-400

TI-2026-36926 CVE-2026-50162 · GHSA-8xwf-rjm4-xvhv

HIGH 70

oras-go is a Go library for managing OCI artifacts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00437 Published 2026-07-17 Partial fix · 2.6.1 CWE-73

TI-2026-36927 CVE-2026-50163 · GHSA-fxhp-mv3v-67qp

MEDIUM 64

oras-go is a Go library for managing OCI artifacts.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00403 Published 2026-07-17 Partial fix · 2.6.2 CWE-22

TI-2026-36234 CVE-2026-48978 · GHSA-xf85-363p-868w

LOW 11

oras-go is a Go library for managing OCI artifacts.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00211 Published 2026-07-17 Partial fix · 2.6.1 CWE-319