wasmtime-wasi
crates.io10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting wasmtime-wasipage 1 of 1
- CVE-2025-53901LOWCVSS 3.5EG 3.5fixed in 24.0.4, 33.0.2 or 34.0.2, by version range2025-07-18
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The spec…
- CVE-2026-115380MEDIUMCVSS 4.0EG 4.049.0.2 (the fix for one version range)2026-10-22
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or…
- CVE-2026-115381MEDIUMCVSS 4.8EG 4.849.0.2 (the fix for one version range)2026-10-22
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configu…
- CVE-2026-115385MEDIUMCVSS 6.2EG 6.249.0.2 (the fix for one version range)2026-10-22
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access …
- CVE-2026-115386LOWCVSS 2.6EG 2.649.0.2 (the fix for one version range)2026-10-22
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preo…
- CVE-2026-115387MEDIUMCVSS 6.2EG 6.249.0.1 (the fix for one version range)2026-10-22
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass…
- CVE-2026-118688HIGHCVSS 7.9EG 7.949.0.3 (the fix for one version range)2026-10-28
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox wri…
- CVE-2026-47261HIGHCVSS 7.5EG 7.5fixed in 44.0.2, 36.0.10, 24.0.9 or 45.0.0, by version range2026-06-05
Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the…
- CVE-2026-54786MEDIUMCVSS 5.0EG 5.0fixed in 24.0.10, 45.0.2, 36.0.11 or 44.0.3, by version range2026-07-01
Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 whic…
- CVE-2026-58494MEDIUMCVSS 6.5EG 6.5fixed in 24.0.11, 36.0.12, 45.0.3 or 46.0.1, by version range2026-07-08
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI …
Check whether wasmtime-wasi is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for wasmtime-wasi CVEs against the assets you own.
Book a Demo →