What’s Vulnerable › Products

oras-project oras-go vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your oras-project oras-go version is affected

Latest oras-project oras-go vulnerabilities

• CVE-2026-85732 — oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing (CVSS 4.7)
• CVE-2026-85731 — oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) (CVSS 8.8)
• CVE-2026-50163 — oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction (CVSS 7.1)
• CVE-2026-50162 — oras-go: file store write outside workingDir via symlink traversal (CVSS 6.9)
• CVE-2026-50151 — oras-go: credential forwarding via unvalidated Location header in blob upload (CVSS 7.5)
• CVE-2026-48978 — oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (CVSS 2.1)