GoPackage

oras.land/oras-go/v2

6 known vulnerabilities (3 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v2.7.0 (Oct 23, 2026): no advisory affects it
Newest unaffected release: v2.7.0 (Oct 23, 2026), the latest release
Advisories: 6 · 3 high, 2 medium, 1 low

Releases: 23 since v2.0.0 (Jan 18, 2023)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-85731
Affects v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
CVE-2026-85732
Affects v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
CVE-2026-50151
Affects v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)
CVE-2026-50162
Affects v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)
CVE-2026-50163
Affects v2.0.0-alpha to v2.6.1 (v2.6.2 is outside it)
CVE-2026-48978
Affects v2.0.0-alpha to v2.6.0 (v2.6.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-85731High 8.8
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Affected: fixed in 2.6.2.
Fixed in v2.6.2 (released Jul 10, 2026, 68 days before disclosure).
The latest release, v2.7.0, is not affected.
CVE-2026-85732Medium 4.7
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
Affected: fixed in 2.6.2.
Fixed in v2.6.2 (released Jul 10, 2026, 68 days before disclosure).
The latest release, v2.7.0, is not affected.
CVE-2026-50151High 7.5
oras-go: credential forwarding via unvalidated Location header in blob upload
Affected: fixed in 2.6.1.
Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
The latest release, v2.7.0, is not affected.
CVE-2026-50162Medium 6.9
oras-go: file store write outside workingDir via symlink traversal
Affected: fixed in 2.6.1.
Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
The latest release, v2.7.0, is not affected.
CVE-2026-50163High 7.1
oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
Affected: fixed in 2.6.2.
Fixed in v2.6.2 (released Jul 10, 2026, 7 days before disclosure).
The latest release, v2.7.0, is not affected.
CVE-2026-48978Low 2.1
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
Affected: fixed in 2.6.1.
Fixed in v2.6.1 (released Jun 3, 2026, 44 days before disclosure).
The latest release, v2.7.0, is not affected.