Threats affecting pkg:cargo/wasmtime-wasi

A vulnerability in Wasmtime wasi's wasip3 UDP `send` function allows sending a datagram to an address that should only be permitted for receiving. This issue affects multiple versions of wasmtime-wasi prior to fixed releases. The flaw has a medium severity with a CVSS score of 6.4 and impacts confidentiality and integrity but not availability. Official patches are available in versions 48.0.8, 49.0.5, and 50.0.1.

A vulnerability in wasmtime-wasi in Wasmtime versions before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 causes a trailing slash to be re-appended to rename source paths. This behavior leads to the renameat system call on macOS and FreeBSD hosts following directory symbolic links. Consequently, a guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox, enabling unauthorized read or write access to those directories.

CVE-2026-58494 is a vulnerability in rust-wasmtime affecting versions prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1. It allows a WASI guest with read-only source file capability to overwrite host files exposed as read-only due to improper permission checks during hard-link creation and renaming. The issue arises because directory permissions are checked but file permissions on source and destination preopens are not properly matched. The vulnerability is fixed in version 46.0.1.