Vulnerability RUSTSEC-2026-0149
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
May 21, 2026 at 12:00 PM UTC
WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
0.2.0 - 24.0.8
0.2.0 - 24.0.8
Summary
WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Details
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph For more information see the GitHub-hosted security advisory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
10 days ago
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
0.2.0 - 36.0.16 RUSTSEC-2026-0321
0.2.0 - 36.0.16 RUSTSEC-2026-0321
Unknown
10 days ago
Excessive allocated memory on the host when guests don't have stdio
0.2.0 - 36.0.16 RUSTSEC-2026-0322
0.2.0 - 36.0.16 RUSTSEC-2026-0322
Unknown
10 days ago
fd_readdir copies uninitialized struct padding into guest memory
0.2.0 - 36.0.16 RUSTSEC-2026-0323
0.2.0 - 36.0.16 RUSTSEC-2026-0323
Medium Risk
10 days ago
Guest can panic host through filesystem timestamp before the epoch on wasip3
46.0.0 - 48.0.3 RUSTSEC-2026-0324
46.0.0 - 48.0.3 RUSTSEC-2026-0324
Medium Risk
18 days ago
Guest can panic host through filesystem datetime overflow
0.2.0 - 36.0.15 RUSTSEC-2026-0314
0.2.0 - 36.0.15 RUSTSEC-2026-0314
Impacted packages
Timeline
Published
4 months ago
May 21, 2026 at 12:00 PM UTC
Fixed (24.0.9)
4 months ago
May 21, 2026 at 06:00 PM UTC
Fixed (45.0.0)
4 months ago
May 21, 2026 at 06:09 PM UTC
Fixed (36.0.10)
4 months ago
May 21, 2026 at 07:03 PM UTC
Fixed (44.0.2)
4 months ago
May 21, 2026 at 07:16 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC