RUSTSEC-2026-0188

vendorUSosv

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination

view advisory published 2026-06-24Licence: CC0-1.0

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj For more information see the GitHub-hosted security advisory.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-58494US	—OT elevated	0.17% (6th)	—	2026-07-08
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching Fil…

references

External citations — patches, advisories, analysis.

https://crates.io/crates/wasmtime-wasiPACKAGE
https://github.com/bytecodealliance/wasmtime/pull/13725WEB
https://rustsec.org/advisories/RUSTSEC-2026-0188.htmlADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan