AIKIDO-2026-10926
wasmtime-wasi is vulnerable to Improper Access Control
75
High Risk
This Affects:
wasmtime-wasiTL;DR
Affected versions of wasmtime-wasi are vulnerable to an access control bypass in filesystem preopen permission handling. A guest application can use file truncation flags with read-only file permissions to modify files despite missing write permissions, bypassing intended FilePerms restrictions in certain DirPerms::MUTATE configurations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
wasmtime-wasi is vulnerable to Improper Access Control in versions 0.0.1 - 24.0.8, 25.0.0 - 36.0.9 and 37.0.0 - 44.0.1.
How to fix this
Upgrade the wasmtime-wasi library to the patch version.
Links
GitHub Releases
github.com/bytecodealliance/wasmtime/releases/tag/v44.0.2github.com/bytecodealliance/wasmtime/releases/tag/v24.0.9github.com/bytecodealliance/wasmtime/releases/tag/v36.0.10github.com/bytecodealliance/wasmtime/releases/tag/v45.0.0
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.