Sandbox Escape Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-118688

8.8HIGH

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118688?

The Wasmtime product from Bytecode Alliance contains a vulnerability that allows a guest with sandbox write access to exploit symlink rename functionality. Specifically, this occurs due to the improper handling of trailing slashes in rename operations, enabling the guest to navigate directory symlinks on macOS and FreeBSD hosts. This could lead to unauthorized access to host directories, allowing potential data breaches or integrity violations within the sandboxed environment.

Affected Version(s)

wasmtime 0 < 36.0.18

wasmtime 37.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-36.0...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rvolosatovs
alexcrichton
.