Possible fix(deps): oras.land/oras-go/v2 v2.6.1 → 2.6.2 (CVE-2026-50163) in go.mod

[begininvoke]

Came across something in modules/har/go.mod around line 1 that looked worth flagging.

CVE-2026-50163 affects the oras-go library (versions < 2.6.2). The ensureLinkPath function validates a hard‑link target against the extraction base but mistakenly returns the original, unresolved target. When a tar archive contains a TypeLink entry, the link is created using os.Link with a path that is later resolved against the process's current working directory, allowing an attacker to create hard‑links to arbitrary files (e.g., .env, .git/config, AWS credentials, SSH config). This can lead to credential exposure or file tampering. The vulnerability is classified as HIGH because it enables unauthorized access to sensitive files on the host.

Something like this might fix it:

```diff
--- a/content/file/utils.go
+++ b/content/file/utils.go
@@
-func ensureLinkPath(base, target string) (string, error) {
-    // Existing logic validates the target but returns it unchanged.
-    // This allows the caller to later resolve the link against the
-    // process's current working directory, leading to path‑traversal
-    // via hard‑links.
-    return target, nil
-}
+func ensureLinkPath(base, target string) (string, error) {
+    // Resolve the link target relative to the extraction base and
+    // clean the resulting path to eliminate any ".." components.
+    // This ensures the link is created inside the intended directory
+    // hierarchy and not against arbitrary files on the host.
+    resolved := filepath.Clean(filepath.Join(base, target))
+
+    // Verify that the resolved path is still within the extraction base.
+    // The check uses a trailing path separator to avoid false positives
+    // when the base itself is a prefix of another path (e.g., "/tmp/base"
+    // vs "/tmp/baseevil").
+    cleanBase := filepath.Clean(base)
+    if !strings.HasPrefix(resolved, cleanBase+string(os.PathSeparator)) && resolved != cleanBase {
+        return "", fmt.Errorf("link target %q escapes extraction base %q", target, base)
+    }
+
+    return resolved, nil
+}
@@
-import (
-    "os"
-    // other imports
-)
+import (
+    "fmt"
+    "os"
+    "path/filepath"
+    "strings"
+    // other imports
+)
```

For reference: rule CVE-2026-50163. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.