oras.land/oras-go/v2 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-VH4V-2XQ2-G5CGMediumoras.land/oras-go/v2: ORAS Go forwards registry credentials across registry redirects CVE-2026-50163Highoras.land/oras-go/v2: `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution CVE-2026-50162Mediumoras.land/oras-go/v2: oras-go has file store write outside workingDir via symlink traversal CVE-2026-50151Highoras.land/oras-go/v2: oras-go blob upload vulnerable to credential forwarding via unvalidated Location header CVE-2026-48978Loworas.land/oras-go/v2: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo