ZeroDay Findings
Sign inSign up

Findings

CVE-2026-58494

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Published Oct 16, 2026 · corrected/updated Oct 16, 2026 · evidence confidence medium

## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass per-preopen and modify host files that were exposed as . This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. ### Details documents as the maximum permissions usable for files in that preopen. However, hard-link creation and renaming only checked directory mutation for permission, and not whether the file permissions matched. This makes an attack possible where: * a read-only file exists in a preopen with only FilePerms::READ * a hardlink named , with destination to the , is created in a preopen with FilePerms::READ | FilePerms::WRITE * the attacker opens the file for writing, in which they can overwrite The same attack is possible by way of renaming: * a read-only file exists in a preopen with only FilePerms::READ * a hardlink named , with destination to the , is created in that same preopen * the file is renamed into a preopen with FilePerms::READ | FilePerms::WRITE * the attacker opens the file for writing, in which they can overwrite Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. ### Remediation The definition of and in wasmtime-wasi's now have an additional permissions check that ensures the source and destination values for the directory permissions and the file permissions are identical. ### Impact Only wasmtime-wasi embeddings that use a combi

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-58494 is a medium public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: wasmtime-wasi (0 → 24.0.11); wasmtime-wasi (25.0.0 → 36.0.12); wasmtime-wasi (37.0.0 → 45.0.3); wasmtime-wasi (46.0.0 → 46.0.1). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 6.5. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-281, CWE-863. Sources contributing to this record: github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass per-preopen and modify host files that were exposed as . This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This a

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    wasmtime-wasi fixed in 24.0.11; wasmtime-wasi fixed in 36.0.12; wasmtime-wasi fixed in 45.0.3; wasmtime-wasi fixed in 46.0.1

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    wasmtime-wasi fixed in 24.0.11

  4. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    wasmtime-wasi fixed in 36.0.12

  5. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    wasmtime-wasi fixed in 45.0.3

  6. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    wasmtime-wasi fixed in 46.0.1

  7. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass per-preopen and modify host files that were exposed as . This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This a

Affected

  • crates.io wasmtime-wasi0 → 24.0.11
  • crates.io wasmtime-wasi25.0.0 → 36.0.12
  • crates.io wasmtime-wasi37.0.0 → 45.0.3
  • crates.io wasmtime-wasi46.0.0 → 46.0.1

Sources

References