{"id":"EUVD-2026-42393","enisaUuid":"679605a2-e5c1-36c7-a8bd-c130f6898d45","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.","datePublished":"Jul 8, 2026, 8:22:16 PM","dateUpdated":"Jul 9, 2026, 1:28:57 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj\nhttps://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c\nhttps://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367\nhttps://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd\nhttps://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1\n","aliases":"CVE-2026-58494\nGHSA-4ch3-9j33-3pmj\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"0f34398b-e600-37f6-8828-7a08a12771a0","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0, \u003c 46.0.1"},{"id":"246d0668-23c9-34f4-a9e3-50e826116a6e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 45.0.3"},{"id":"479b7482-ff07-3bcc-a108-94f3275ff0b5","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.12"},{"id":"93f0849b-7adb-36e6-8e05-e598b29946c6","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.11"}],"enisaIdVendor":[{"id":"53531d36-e14d-3bb4-aa8d-76a5fac3938a","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"0ad79d55-6f3b-31dc-8a7b-af1ad4669093","vulnerability":{"id":"GHSA-4ch3-9j33-3pmj","description":"Wasmtime: WASI hard links bypass wasmtime-wasi\u0027s FilePerms for destination","datePublished":"Oct 16, 2026, 7:57:26 PM","dateUpdated":"Oct 16, 2026, 7:57:26 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58494\nhttps://github.com/bytecodealliance/wasmtime/pull/13725\nhttps://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c\nhttps://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367\nhttps://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd\nhttps://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e\nhttps://github.com/bytecodealliance/wasmtime\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0188.html\n","enisa_id":"EUVD-2026-42393\n","aliases":"CVE-2026-58494\nGHSA-4ch3-9j33-3pmj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a10929c6-3b47-3ad2-aa1c-e682b5ebc5b2","vulnerability":{"id":"CVE-2026-58494","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.","datePublished":"Jul 8, 2026, 8:22:16 PM","dateUpdated":"Jul 9, 2026, 1:28:57 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj\nhttps://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c\nhttps://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367\nhttps://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd\nhttps://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1\n","enisa_id":"EUVD-2026-42393\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"2e61bde7-e1bc-3a02-be35-702912644892","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0, \u003c 46.0.1"},{"id":"83ec96a1-11a7-3544-b5e5-4719eadbcd31","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.12"},{"id":"ab3eb785-cf60-3ec6-8b20-d6e8a258c33f","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.11"},{"id":"b65a5c01-01e4-3647-a09d-1a8d4eb5f685","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 45.0.3"}],"vulnerabilityVendor":[{"id":"b0a9a20e-7cbe-3cf7-856f-f713d789b524","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}