Threats tagged 'ghsa-4ch3-9j33-3pmj'

CVE-2026-58494 is a vulnerability in rust-wasmtime affecting versions prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1. It allows a WASI guest with read-only source file capability to overwrite host files exposed as read-only due to improper permission checks during hard-link creation and renaming. The issue arises because directory permissions are checked but file permissions on source and destination preopens are not properly matched. The vulnerability is fixed in version 46.0.1.