Wasmtime CVE-2026-115392

Exploitation requires the host to run wasmtime-wasi on macOS OR on a Linux kernel without the openat2 syscall (pre-5.6 or openat2 otherwise unavailable); Linux 5.6+ with openat2 fully mitigates because cap-std then uses the RESOLVE_BENEATH flag. The attacker must control a guest WebAssembly module that the host has granted a sandboxed directory: write access to any sandboxed directory yields full arbitrary host read/write, while read-only access yields host file disclosure only when exploitable symlinks already exist in that directory. The trigger is a symlink/path with a trailing slash that cap-std mishandles. Limiting factors: modern Linux (openat2) is immune, the read-only escape depends on preexisting symlinks, and the guest must be untrusted/attacker-controlled - so deployments running only trusted guests are not practically exposed.

This is a genuine high-priority sandbox escape (CVSS 4.0 base 8.8), not an inflated score. The flaw defeats wasmtime-wasi's core security guarantee - filesystem isolation of untrusted guests - letting a write-capable guest read and write any host-accessible file (CWE-61 symlink following), and letting read-only guests read host files through preexisting symlinks. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P with VC:H/VI:H and SC:H/SI:H) correctly models a scope-changing guest-to-host compromise. The signals are mostly aligned toward real-but-not-emergency risk: vuln.today assigns the 'this_week' decision label, there is no CISA KEV listing (not confirmed as actively exploited), no EPSS score was provided, and no working PoC exploit code is referenced - only the GHSA and VulnCheck advisories describing the mechanism. Two caveats materially shape real-world risk. First, attack vector: AV:N is reasonable for the canonical Wasmtime use case (edge/serverless running remotely-supplied untrusted Wasm), but in embedded deployments where guests are trusted or locally supplied the practical vector is local and risk drops. Second, AT:P reflects a hard platform limit - Linux 5.6+ kernels with the openat2 syscall are NOT affected because cap-std uses RESOLVE_BENEATH; exposure is confined to macOS hosts and older/openat2-less Linux. Net: treat as urgent where untrusted guests run on macOS or pre-openat2 Linux; de-prioritize where guests are trusted or hosts run modern Linux.

An edge or serverless platform executes untrusted WebAssembly guests via wasmtime-wasi on macOS or an older Linux kernel lacking openat2. A malicious guest granted write access to its sandboxed directory creates or follows a symlink with a trailing slash to escape the sandbox and read/write any file the host process can access; a read-only guest may read host files through symlinks already present in its directory. No public exploit code is identified, but the GHSA and VulnCheck advisories detail the trailing-slash mechanism.