—

GO-2026-5880

Hardlink path traversal during tar extraction in oras.land/oras-go

Quick fix

GO-2026-5880 — oras.land/oras-go/v2: upgrade to the fixed version with the command below.

go get oras.land/oras-go/v2@v2.6.2

Details

Hardlink path traversal during tar extraction in oras.land/oras-go

Enter the version of the package you're using.

Introduced in: 0 Fixed in: 2.6.2

Fix go get oras.land/oras-go/v2@v2.6.2