Malicious code in wasmer-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e66b8e03768b197df9ac09bcb9d0dc5b58d3bf49ea8d2474649c6aad97e9f18e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-38358

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358 vulnerabilities

Vulnerabilities for packages: zellij, wasmer...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer

Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...

Wasmer Security Breach

Wasmer is a Wasmer open source application that enables lightweight containers to run anywhere. A security vulnerability exists in Wasmer versions prior to 4.3.2 that stems from bypassing the file system sandbox...

GHSA-55F3-3QVG-8PV5 vulnerabilities

Vulnerabilities for packages: wasmer, zellij...

GHSA-55F3-3QVG-8PV5 Symlink bypasses filesystem sandbox

Summary If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime by creating a symlink pointing outside with pathsymlink and pathopeni...

cbqn (>=0.1.1, <=0.2.4), exers (0.2.0) +42 more potentially affected by CVE-2024-38358 via wasmer (>=4.0.0, <=4.3.0-beta.1)

wasmer CARGO version =4.0.0, =0.1.1, =0.3.0, =0.2.0, =0.6.0, =0.78.0, =0.3.0-beta-dev.35, =0.1.0, =0.1.0, =0.3.0-beta-dev.35, =0.3.0-beta-dev.35, =0.3.0, =0.5.0, =0.9.0, =0.0.1, =0.4.0-dev.7 and more Source cves: CVE-2024-38358 Source advisory: OSV:GHSA-55F3-3QVG-8PV5...

GHSA-55F3-3QVG-8PV5 vulnerabilities

Vulnerabilities for packages: zellij, wasmer...

CVE-2023-51661

Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This...

CVE-2023-51661 Filesystem sandbox not enforced in wasmer-cli

Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This...

CVE-2023-51661 Filesystem sandbox not enforced in wasmer-cli

Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This...

Wasmer filesystem sandbox not enforced

Summary As of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox. Details https://github.com/wasmerio/wasmer/issues/4267 PoC A minimal Rust program: fn main let f = std::fs::OpenOptions::new .writetrue .createnewtrue .open"abc" .unwrap; This should be compiled...

assemblylift-cli (>=0.4.0-alpha.5, <=0.4.0-alpha.11), assemblylift-core (>=0.4.0-alpha.10, <=0.4.0-alpha.11) +46 more potentially affected by CVE-2023-26489 via wasmtime (>=0.37.0, <=3.0.1)

wasmtime CARGO version =0.37.0, =0.4.0-alpha.5, =0.4.0-alpha.10, =0.1.0, =0.1.0, =0.1.3, =0.5.0, =0.5.1, =0.0.1, =0.0.1-alpha, =0.11.0, =0.3.1, =0.0.6, =0.1.0, =0.2.1 - linera-wit-bindgen-gen-host-wasmtime-rust 0.2.0 and more Source cves: CVE-2023-26489 Source advisory: OSV:GHSA-FF4P-7XRQ-Q5R8...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31104 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

wasmtime-cli (>=0.35.0, <=0.35.1) potentially affected by CVE-2022-24791 via wasmtime (>=0.35.0, <=0.35.1)

wasmtime CARGO version =0.35.0, =0.35.0, =0.35.1 Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0016...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +50 more potentially affected by CVE-2022-24791 via wasmtime (>=0.7.0, <=0.34.1)

wasmtime CARGO version =0.7.0, =0.1.0, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.4.1 and more Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0099...