CVE-2026-47218

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

EUVD-2026-102247

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

CVE-2026-47218

The runwasi project contains a vulnerability in containerd-shim-wasmtime-v1 prior to version 0.6.1 . The flaw allows an attacker to provide Wasmtime precompiled bytes directly within an OCI image layer, which the shim incorrectly treats as a trusted artifact from the precompile-cache path. By des...

CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

PT-2026-115107

Name of the Vulnerable Software and Affected Versions runwasi versions prior to 0.6.1 Description In containerd-shim-wasmtime-v1, Wasmtime precompiled bytes provided in an OCI image layer can be incorrectly treated as trusted artifacts from the precompile-cache path and deserialized as native cod...

CVE-2026-47218: Deserialization of Untrusted Data

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

Panic when invoking an async-lifted function via `call`

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory...

Component-model handle tables are capped only per instance and charged to no limit

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory...

Panic on erroneous call-to-host from guest realloc call

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory...

Filesystem sandbox escape when renaming symlinks with trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory...

Guests can send absolute-form HTTP requests to different hosts

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory...

Overlapping string transcode in a fused adapter can panic

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory...

Wasmtime may not properly enforce async-entrypoint requirement

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory...

Host panic when component `call_async` is cancelled under some conditions

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory...

Stack overflow dropping a long chain of recursive types

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0352 Filesystem sandbox escape when renaming symlinks with trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0357 Out-of-bounds zero-length stream writes can panic

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory...