containerd runwasi: Code execution via forged precompiled Wasmtime layer in OCI image
Summary
runwasi is a containerd project for running Wasm and WASI workloads. Prior to version 0.6.1, containerd-shim-wasmtime-v1 treats Wasmtime precompiled bytes supplied in an OCI image layer as trusted and deserializes them as native code, skipping WebAssembly validation. An attacker who gets a victim to run a crafted image can execute native code in the shim zygote process with the filesystem, environment, credentials, network and syscall access of the workload container. The flaw does not by itself break container isolation or give direct host code execution.
Affected
- runwasi (containerd-shim-wasmtime) before 0.6.1
- Downstream shims built on the containerd-shim-wasm precompile-cache API that trust precompiled artifacts from OCI image layers; their versions are unknown.
Fixed in
- containerd-shim-wasmtime 0.6.1
- Downstream shims: Unknown, each vendor must confirm its own fix.
Workaround
- Unknown. No vendor workaround was identified in the sources.
Exploitation
- No evidence of exploitation in the wild found. CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found in the searches performed.
Our recommendation
- Check whether containerd-shim-wasmtime or other Wasm runtime handlers are installed (containerd configuration and binaries).
- If present, upgrade containerd-shim-wasmtime to 0.6.1 or later and check downstream shims with the vendor.
- Until patched, only run Wasm images from trusted, controlled registries and restrict who can deploy images to these hosts.
- If no Wasm runtime handlers are used, no action is needed beyond monitoring.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cc25-vq59-rcjx github.com
- runwasi commit d28ab73 (fix) github.com
- runwasi release containerd-shim-wasmtime v0.6.1 github.com
- OpenCVE CVE-2026-47218 app.opencve.io
- VulDB 420770 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:35.
Original description (NVD)
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.