Wasmtime wasi: Sandbox escape via symlink rename on macOS and FreeBSD
Summary
The wasmtime-wasi component of Wasmtime re-appends a trailing slash to source paths during rename operations. On macOS and FreeBSD hosts, renameat then follows directory symlinks, so a guest with write access to its sandbox can move host directories into the sandbox and read or write their contents. Linux and Windows hosts are not affected. Exploitation requires the attacker to control a guest module that runs with sandbox write access.
Affected
- Wasmtime before 36.0.18
- Wasmtime 37.0.0 before 48.0.6
- Wasmtime 49.0.0 before 49.0.3
- Only macOS and FreeBSD hosts are affected according to the vendor advisory
Fixed in
- Wasmtime 36.0.18
- Wasmtime 48.0.6
- Wasmtime 49.0.3
- Unknown whether a fix exists for the 37.x line.
Workaround
Unknown. The vendor states that there is no known workaround; upgrading is the recommended remedy.
Exploitation
- Publicly documented with a proof-of-concept approach in the vendor advisory; the vendor describes it as a full filesystem sandbox escape.
- No evidence of in-the-wild exploitation was found as of 31 Oct 2026.
- EPSS: 0.24 % (percentile 15).
Our recommendation
- Upgrade to Wasmtime 36.0.18, 48.0.6 or 49.0.3 (or later patch releases) on all macOS and FreeBSD hosts.
- Identify systems that run untrusted WebAssembly modules on these platforms and prioritise them.
- Check whether any Wasmtime-based applications bundle an older wasmtime-wasi version and update them.
- Monitor vendor releases for further information.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m9f7-9w4p-gv38 github.com
- VulnCheck advisory www.vulncheck.com
- Wasmtime release 36.0.18 github.com
- Wasmtime releases github.com
- Wasmtime security overview github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:25.
Original description (NVD)
wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.