Linux Distros Unpatched Vulnerability : CVE-2025-53901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions ca...

CVE-2025-54126: Exposure of Resource to Wrong Sphere

The WebAssembly Micro Runtime's WAMR iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface WASI and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an IPv4 address that lacks a subnet mask, allowing the system to...

SUSE CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

UBUNTU-CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901: Operation on a Resource after Expiration or Release

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

Malicious code in wasm-wasi-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 320ad464f0780881fe134c1e9990c2e1a180a2ab4b6b103e26439d8861709021 Any computer that has this package installed or running should be considered...

MAL-2025-5067 Malicious code in wasm-wasi-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 320ad464f0780881fe134c1e9990c2e1a180a2ab4b6b103e26439d8861709021 Any computer that has this package installed or running should be considered...

candid-extractor (>=0.1.0, <=0.1.2), purewasm (0.1.0) +12 more potentially affected by CVE-2024-47763 via wasmtime (12.0.2)

wasmtime CARGO version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - candid-extractor =0.1.0, =12.0.0, =12.0.0, =12.0.0, =0.1.2, =0.3.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.2 Source cves:...

MAL-2025-1004 Malicious code in wasi8787878 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e7e8dad2dca9000e3bd94355a78838c2c9448aac766722cfd54aba1fc5c2cd43 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2024-38358

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358

Wasmer (a WASM runtime) is affected by CVE-2024-38358 due to a bug where preopened directories containing a symlink pointing outside can be exploited to traverse the symlink and access the host filesystem if the caller uses both oflags::creat and rights::fd_write. The issue can also crash the run...

CVE-2024-38358: Improper Limitation of a Pathname to a Restricted Directory

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

GHSA-55F3-3QVG-8PV5 Symlink bypasses filesystem sandbox

Summary If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime by creating a symlink pointing outside with pathsymlink and pathopeni...

Symlink bypasses filesystem sandbox

Summary If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime by creating a symlink pointing outside with pathsymlink and pathopeni...

Node.js: WASI sandbox escape via symlink

A WASI + WASM program was discovered to be able to use pathsymlink to read arbitrary files on the host machine by creating a symlink in a preopen to a different location on the local file system, thereby escaping the WASI sandbox...

Fastly Compute@Edge JS Runtime has fixed random number seed during compilation

Impact Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG cryptographically secure pseudorandom number generator was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for th...

GHSA-CMR8-5W4C-44V8 Fastly Compute@Edge JS Runtime has fixed random number seed during compilation

Impact Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG cryptographically secure pseudorandom number generator was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for th...

Wasmtime Resource Management Error Vulnerability

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. a resource management error vulnerability exists in Wasmtime, which stems from the fact that when running Wasm with externrefs and epoch interrupts are enabled in Wasmtime, a use after...