CVE-2026-47218: CWE-502: Deserialization of Untrusted Data in containerd runwasi
Description
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
CVSS v4.0
Score 9.3critical
Affected software
containerd
runwasi
pkg:github/containerd/runwasiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability affects containerd-shim-wasmtime-v1 prior to version 0.6.1, where Wasmtime precompiled bytes embedded in an OCI image layer are trusted and deserialized as native code without proper validation. An attacker who causes a victim to run a specially crafted image can bypass WebAssembly validation and execute arbitrary native code within the shim zygote process. This leads to compromise of the workload container's resources including filesystem, environment variables, credentials, networking, and Linux syscalls. Downstream shims using runwasi's containerd-shim-wasm precompile-cache API and trusting executable precompiled artifacts from OCI image layers may also be affected. The flaw does not allow direct host code execution or container isolation escape. The vulnerability is addressed in containerd version 0.6.1.
Potential Impact
Successful exploitation allows an attacker to execute native code in the shim zygote process, gaining full access to the workload container's filesystem, environment, credentials, networking, and Linux syscalls. This compromises the workload container but does not provide direct host system access or break container isolation.
Mitigation Recommendations
Upgrade containerd to version 0.6.1 or later, where this vulnerability is fixed. Downstream products using runwasi's containerd-shim-wasm precompile-cache API should verify their versions and apply equivalent patches if available. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T22:25:21.258Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad11cac2cdf04f6565042e3
Added to database: 10/15/2026, 18:34:20 UTC
Last enriched: 10/15/2026, 18:48:21 UTC
Last updated: 10/15/2026, 20:19:18 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.