The vulnerability exists in the oras-go library's tar extraction code, specifically in the ensureLinkPath function that validates hardlink targets. While it validates that the resolved absolute path of a hardlink target is inside the extraction base directory, it returns the original relative target path to the caller. The caller then uses os.Link to create the hardlink, which resolves the relative oldname argument against the process's current working directory (CWD), not the extraction directory. An attacker can craft a tarball with a relative hardlink target that passes validation but causes the hardlink to point to a file outside the extraction directory relative to the CWD. This results in a hardlink inside the extraction directory sharing an inode with a file in the CWD, allowing reading or writing to the CWD file via the extracted hardlink. The issue affects oras-go versions up to and including 2.6.1. No official patch or remediation information is provided in the advisory.

This vulnerability allows an attacker who controls an OCI-compliant registry or artifact source to cause the victim's oras-go client to create hardlinks inside the extraction directory that point to arbitrary files in the victim's current working directory. This effectively provides an arbitrary file read primitive on files in the CWD, potentially exposing sensitive data. The attacker cannot escalate privileges or cause denial of service directly but can read files that the victim process has access to and that exist in the CWD at extraction time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid pulling and auto-extracting OCI artifacts from untrusted sources using oras-go versions up to 2.6.1. Consider running extraction in a controlled environment where the process CWD is isolated or does not contain sensitive files. Monitor vendor channels for an official fix or update.