Read the docs
TI-2026-74982 Aliases CVE-2026-47218

Forged Wasmtime precompiled OCI layer escapes runwasi WASI sandbox

Priority MEDIUM 48CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

runwasi before 0.6.1 is affected. containerd-shim-wasmtime-v1 treats Wasmtime precompiled bytes in an OCI image layer as trusted and deserializes them as native code (CWE-502). An attacker who causes a victim to run a crafted image can run native code in the shim zygote process, bypassing WebAssembly validation. The flaw does not by itself bypass container isolation or give direct host code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed runwasi (containerd): 0.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagerunwasibefore 0.6.10.6.1Patch availableCNA
  • runwasi Vendorbackstage Affected before 0.6.1 Fixed in 0.6.1 Patch available CNA

Remediation

Upgrade runwasi to version 0.6.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA runwasi (containerd) Fixed in 0.6.1

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-47218

References

Other 3

  • TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
  • TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
  • TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
  • TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
  • TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
See all 662 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences