Filesystem Sandbox Escape in Wasmtime: Trailing Slash Vulnerability
Summary
RUSTSEC-2026-0269: Filesystem sandbox escape when paths or symlinks contain trailing slashes. Affects wasmtime across 4 version ranges.
>= 0.0.0-0, < 24.0.13
>= 25.0.0, < 36.0.14
>= 37.0.0, < 46.0.3
>= 47.0.0, < 47.0.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly code efficiently and securely. It provides a sandboxed environment for running untrusted code, making it a popular choice for applications that require safe execution of potentially harmful code. However, a recent vulnerability has been identified that allows for a filesystem sandbox escape when paths or symlinks contain trailing slashes, which could lead to unauthorized access to the host filesystem.
Vulnerability Detail
The vulnerability arises from improper handling of paths and symlinks in Wasmtime, specifically when they contain trailing slashes. This flaw can be exploited by an attacker to escape the intended sandbox environment, potentially gaining access to sensitive files on the host system. The CVSS score of this vulnerability is 8.8, indicating a high severity level. Attackers could leverage this issue to execute arbitrary code or access confidential data, posing significant risks to applications relying on Wasmtime for secure execution.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 24.0.1324.0.13 -
>= 25.0.0, < 36.0.1436.0.14 -
>= 37.0.0, < 46.0.346.0.3 -
>= 47.0.0, < 47.0.447.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any paths or symlinks used in your application do not contain trailing slashes. This can help mitigate the risk of filesystem sandbox escape until the package is updated to a secure version.
Conclusion
The filesystem sandbox escape vulnerability in Wasmtime poses significant risks to applications using this package. It is crucial to update to the latest patched versions to mitigate these risks and ensure the security of your application. Additionally, implementing workarounds can help reduce exposure until an update is applied.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability allows for a filesystem sandbox escape when paths or symlinks contain trailing slashes, potentially exposing the host filesystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files and execution of arbitrary code on the host system.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Update your Cargo.toml file to specify a patched version of Wasmtime, such as 47.0.4, and run 'cargo update' to install the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
