wasmtime-wasi has 11 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 6.2 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 9 prev 2
Worst active — by depth score
CVE-2026-47261High· 7.5WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction41CVE-2026-58494Medium· 6.5Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination36RUSTSEC-2026-0324Medium· 6.2Guest can panic host through filesystem timestamp before the epoch on wasip334RUSTSEC-2026-0314Medium· 6.2Guest can panic host through filesystem datetime overflow34CVE-2026-115387Medium· 6.2Guest can panic host through filesystem datetime overflow34
wasmtime-wasi vulnerabilities
CVEs affecting wasmtime-wasi, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-58494Medium· 6.5Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
RUSTSEC-2026-0352NoneFilesystem sandbox escape when renaming symlinks with trailing slashes
Filesystem sandbox escape when renaming symlinks with trailing slashes
CVE-2026-115386Low· 2.6fd_readdir copies uninitialized struct padding into guest memory
fd_readdir copies uninitialized struct padding into guest memory
RUSTSEC-2026-0324Medium· 6.2Guest can panic host through filesystem timestamp before the epoch on wasip3
Guest can panic host through filesystem timestamp before the epoch on wasip3
RUSTSEC-2026-0323Nonefd_readdir copies uninitialized struct padding into guest memory
fd_readdir copies uninitialized struct padding into guest memory
RUSTSEC-2026-0322NoneExcessive allocated memory on the host when guests don't have stdio
Excessive allocated memory on the host when guests don't have stdio
RUSTSEC-2026-0321Medium· 4.0WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
CVE-2026-115387Medium· 6.2Guest can panic host through filesystem datetime overflow
Guest can panic host through filesystem datetime overflow
RUSTSEC-2026-0314Medium· 6.2Guest can panic host through filesystem datetime overflow
Guest can panic host through filesystem datetime overflow
CVE-2026-54786LowLeak in WASIp1 `fd_renumber` implementation
Leak in WASIp1 `fd_renumber` implementation
CVE-2026-47261High· 7.5⚖ disputedWASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction