Please follow the security policy to report a security vulnerability or concern.
Security: oras-project/oras
Security
SECURITY.md
-
Attacker-controlled OCI descriptor size causes unrecovered panic and process crash in ORAS CLIGHSA-f36w-mj3v-6jqv published
Jul 24, 2026 by TerryHoweModerate -
Tarballs with links can escape working directory upon extraction ("zip slip")GHSA-g5v4-5x39-vwhx published
Jan 22, 2021 by jdolitskyHigh
Learn more about advisories related to oras-project/oras in the GitHub Advisory Database