CVE-2021-21272: Zip Slip Directory Exploit in github.com/deislabs/oras
Summary
CVE-2021-21272: Zip slip directory exploit in github.com/deislabs/oras. Affects github.com/deislabs/oras versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Also tracked for
- oras · Bitnami
The same CVE-2021-21272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/deislabs/oras is a Go library and CLI tool for working with OCI Artifacts. It provides functionality for pulling, pushing, and managing container images and other artifacts. The vulnerability in this package allows for a directory traversal attack known as Zip Slip. This attack occurs when a malicious artifact provider is able to write or overwrite files outside of the intended directory, potentially leading to unauthorized access or code execution on the host system. The vulnerability affects users of the oras CLI tool and Go programs that use the github.com/deislabs/oras/pkg/content.FileStore.
Vulnerability Detail
The Zip Slip vulnerability in github.com/deislabs/oras allows for the extraction of gzipped tarballs to a user-specified directory. However, the tarball can contain symbolic links and hard links that can be exploited by a well-crafted artifact. This allows a malicious provider to link, write, or overwrite files on the host filesystem outside of the intended directory. The impact of this vulnerability is that an attacker can gain unauthorized access or execute arbitrary code with the same permissions as the user running the oras pull command or the affected Go program. The vulnerability has a CVSS score of 7.7.
How To Fix
Latest published version: v0.11.1 as of 23 Oct 2026
go get github.com/deislabs/oras@v0.11.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
go get github.com/deislabs/oras@v0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For oras CLI users, the only workaround is to pull artifacts from trusted providers. This reduces the risk of encountering a malicious artifact that exploits the Zip Slip vulnerability. For users of the oras package in Go programs, an alternative workaround is to avoid using the github.com/deislabs/oras/pkg/content.FileStore and instead use other content stores or pull from trusted providers.
Conclusion
The Zip Slip vulnerability in github.com/deislabs/oras allows for unauthorized access and potential code execution on the host system. Users should upgrade to version 0.9.0 of the oras CLI and packages to mitigate this vulnerability. It is recommended to pull artifacts from trusted providers and avoid using the affected content store in Go programs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/deislabs/oras →
FAQ
Zip Slip is a directory traversal attack that occurs when a malicious archive file is able to write or overwrite files outside of the intended extraction directory. It is a common vulnerability in archive extraction libraries.
Users of the oras CLI tool and Go programs that use the github.com/deislabs/oras/pkg/content.FileStore are affected by this vulnerability.
The impact of this vulnerability is that an attacker can gain unauthorized access or execute arbitrary code on the host system with the same permissions as the user running the oras pull command or the affected Go program.
To fix this vulnerability, users should upgrade their oras CLI and packages to version 0.9.0. This version includes a patch that addresses the Zip Slip vulnerability.
For oras CLI users, the only workaround is to pull artifacts from trusted providers. For users of the oras package in Go programs, an alternative workaround is to avoid using the github.com/deislabs/oras/pkg/content.FileStore and instead use other content stores or pull from trusted providers.
