How severe is GHSA-77vh-xpmg-72qh?

GHSA-77vh-xpmg-72qh has a CVSS score of 3/10, rated LOW. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-77vh-xpmg-72qh?

GHSA-77vh-xpmg-72qh affects the following packages: github.com/opencontainers/image-spec (Go). Ecosystems affected: Go.

How do I fix GHSA-77vh-xpmg-72qh?

Update github.com/opencontainers/image-spec to 1.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-77vh-xpmg-72qh is resolved across your whole dependency graph.

How do I detect GHSA-77vh-xpmg-72qh in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/opencontainers/image-spec, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-77vh-xpmg-72qh if there is no patch (or I can't update yet)?

Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Is GHSA-77vh-xpmg-72qh actively exploited in the wild?

No public exploit code has been indexed for GHSA-77vh-xpmg-72qh yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-77vh-xpmg-72qh published, and has it been updated?

GHSA-77vh-xpmg-72qh was published on November 18, 2021 and was last updated on September 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

LOW severity

Clarify `mediaType` handlingGHSA-77vh-xpmg-72qh

LOWFix: opencontainers/image-spec@693428a

GHSA-77vh-xpmg-72qh is a low-severity (CVSS 3) remote code execution vulnerability in github.com/opencontainers/image-spec. A fix is available for github.com/opencontainers/image-spec — see the affected versions and patch details below.

Published

Nov 18, 2021

Updated

Sep 10, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Sep 10, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/opencontainers/image-spec

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.

Patches

The Image Specification will be updated to recommend that both manifest and index documents contain a mediaType field to identify the type of document. Release v1.0.2 includes these updates.

Workarounds

Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields.

References

https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/opencontainers/image-spec
Email us at [email protected]
https://github.com/opencontainers/image-spec/commits/v1.0.2

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/opencontainers/image-spec`	all versions	1.0.2`go get github.com/opencontainers/image-spec@v1.0.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/opencontainers/image-spec, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/opencontainers/image-spec to 1.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-77vh-xpmg-72qh is resolved across your whole dependency graph.
Workarounds
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Frequently Asked Questions

### Impact In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index. ### Patches The Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document. Release [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates. ### Workarounds Software attempting to deserialize an ambiguous document may reject the document if it contains bot

O3 Security · Impact-Aware SCA

Is GHSA-77vh-xpmg-72qh in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works