Skip to content
OpenAdvisories

Package · crates.io

wasmtime-wasi

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.9
    CVE-2026-118688

    Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

    wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename…

    bytecodealliance wasmtime rust-wasmtime wasmtime-wasi Debian crates.io
  • High 7.5
    CVE-2026-47261

    Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

    Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.o…

    bytecodealliance wasmtime rust-wasmtime zed Debian Ubuntu Wolfi crates.io