Skip to main content
Version: v1.2.x

CVE-2026-50163

CVE Details

Visit the official vulnerability details page for CVE-2026-50163 to learn more.

Initial Publication

07/17/2026

Last Update

07/23/2026

Third Party Dependency

oras.land/oras-go/v2

NIST CVE Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

CVE Severity

7.1

Our Official Summary

Investigation is ongoing to determine how this vulnerability affects our products.

Status

Deferred

Affected Products & Versions

VersionPaletteAIPaletteAI VerteX
1.2.1⚠️ Impacted⚠️ Impacted
1.1.8⚠️ Impacted⚠️ Impacted

Revision History

No revisions available.