oras-project/oras-java Security Advisories | GitStock

low2026-07-01

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

GHSA-j6hm-v3x2-qv6j

high2026-05-19

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

GHSA-xm96-gfjx-jcrc