Security: oras-project/oras
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Attacker-controlled OCI descriptor size causes unrecovered panic and process crash in ORAS CLIGHSA-f36w-mj3v-6jqv published
Jul 24, 2026 by TerryHoweModerate -
Tarballs with links can escape working directory upon extraction ("zip slip")GHSA-g5v4-5x39-vwhx published
Jan 22, 2021 by jdolitskyHigh