oras-go has file store write outside workingDir via symlink traversal
Moderate severity
GitHub Reviewed
Published
Jun 11, 2026
in
oras-project/oras-go
•
Updated Jul 1, 2026
Give feedback on Dependabot alerts