Skip to content
OpenAdvisories

Package · Debian

rust-wasmtime

38 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.9
    CVE-2026-118688

    Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

    wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename…

    bytecodealliance wasmtime rust-wasmtime wasmtime-wasi Debian crates.io
  • High 7.9
    CVE-2026-115392

    Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes

    Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking open…

    bytecodealliance wasmtime wasmtime rust-wasmtime Debian Ubuntu crates.io
  • High 7.5
    CVE-2026-47261

    Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

    Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.o…

    bytecodealliance wasmtime rust-wasmtime rust-wasmtime Debian Ubuntu crates.io