CVE-2021-21272: Zip Slip Directory Exploit in github.com/deislabs/oras
Summary
CVE-2021-21272: Zip slip directory exploit in github.com/deislabs/oras. Affects github.com/deislabs/oras versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Also tracked for
- oras · Bitnami
The same CVE-2021-21272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/deislabs/oras package is a Go library and CLI tool for working with OCI artifacts. It provides functionality for pulling, pushing, and managing container images and other artifacts. The package is widely used in Go programs and by the oras CLI tool. This vulnerability affects versions prior to 0.9.0 of the package.
Vulnerability Detail
The vulnerability, known as Zip Slip, arises from the directory support feature in the oras package. This feature allows gzipped tarballs to be automatically extracted to a user-specified directory. However, if a malicious artifact provider crafts a tarball with symbolic links or hard links, it can exploit this feature to write or overwrite files outside of the user-specified directory on the host filesystem. This can lead to unauthorized access, data corruption, or other unexpected behavior. The vulnerability affects users of the oras CLI tool and Go programs that use the github.com/deislabs/oras/pkg/content.FileStore.
How To Fix
Latest published version: v0.11.1 as of 23 Oct 2026
go get github.com/deislabs/oras@v0.11.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
go get github.com/deislabs/oras@v0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For oras CLI users, the only workaround is to pull artifacts from trusted providers. For users of the oras package, an alternative content store can be used instead of the vulnerable FileStore. Additionally, pulling from trusted artifact providers can mitigate the risk of exploitation.
Conclusion
The Zip Slip Directory Exploit in the github.com/deislabs/oras package allows malicious artifact providers to write or overwrite files outside of the intended extraction directory. Users can mitigate this vulnerability by upgrading to version 0.9.0 of the oras package and CLI tool. It is recommended to pull artifacts from trusted providers and avoid using the vulnerable FileStore in Go programs. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/deislabs/oras →
FAQ
Zip Slip is a vulnerability that occurs when an application extracts files from a zip or tar archive without properly validating the paths of the extracted files. This can allow an attacker to write or overwrite files outside of the intended extraction directory.
Users of the oras CLI tool who run 'oras pull' and Go programs that use the github.com/deislabs/oras/pkg/content.FileStore are affected by this vulnerability.
The consequences of this vulnerability include unauthorized access to sensitive files, data corruption, and unexpected behavior of the affected application.
There are no known public exploits of this vulnerability at the time of this advisory.
For more information, you can open an issue on the GitHub repository of the oras package or email the list of maintainers.
