# wasmtime-wasi (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/wasmtime-wasi Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/wasmtime-wasi.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in wasmtime-wasi (crates.io): 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, RUSTSEC-2026-0420 - wasip3 UDP `send` can deliver a datagram to an address…, was published on 29 October 2026. 2 vulnerabilities in the last four weeks, down 60% on the four before (5). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 7 - All time: 11 (0 critical, 0 exploited in the wild) ## About wasmtime-wasi (crates.io) A Rust implementation of the WebAssembly System Interface (WASI) for the Wasmtime runtime. ## Latest wasmtime-wasi (crates.io) vulnerabilities - [RUSTSEC-2026-0420 - wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving](https://junglewise.ai/threats/rustsec-2026-0420-wasip3-udp-send-can-deliver-a-datagram-to-an-address-cfc65c09) (low, CVSS 3.1, published 29 Oct 2026) - [Wasmtime-WASI filesystem sandbox escape with symlink rename](https://junglewise.ai/threats/rustsec-2026-0352-filesystem-sandbox-escape-when-renaming-symlinks-with-86b22c86) (medium, CVSS 4, published 14 Oct 2026) - [RUSTSEC-2026-0324 - Guest can panic host through filesystem timestamp before the epoch on wasip3](https://junglewise.ai/threats/rustsec-2026-0324-guest-can-panic-host-through-filesystem-timestamp-681be084) (low, CVSS 3.1, published 2 Oct 2026) - [wasmtime-wasi excessive memory allocation when guests lack stdio](https://junglewise.ai/threats/rustsec-2026-0322-excessive-allocated-memory-on-the-host-when-guests-84ef0787) (medium, CVSS 4, published 2 Oct 2026) - [Wasmtime wasmtime-wasi fd_readdir information disclosure](https://junglewise.ai/threats/rustsec-2026-0323-fd-readdir-copies-uninitialized-struct-padding-into-ed3c3a69) (medium, CVSS 4, published 2 Oct 2026) - [RUSTSEC-2026-0321 - WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption](https://junglewise.ai/threats/rustsec-2026-0321-wasi-preview-0-implementation-of-poll-oneoff-67c5f6e0) (low, CVSS 3.1, published 2 Oct 2026) - [RUSTSEC-2026-0314 - Guest can panic host through filesystem datetime overflow](https://junglewise.ai/threats/rustsec-2026-0314-guest-can-panic-host-through-filesystem-datetime-dc05cfdb) (low, CVSS 3.1, published 24 Sep 2026) - [CVE-2026-58494: Bytecode Alliance Wasmtime improper permission preservation in wasmtime-wasi](https://junglewise.ai/threats/cve-2026-58494-bytecode-alliance-wasmtime-improper-permission-preservation-in) (medium, CVSS 6.5, published 8 Jul 2026) - [CVE-2026-54786: Bytecode Alliance Wasmtime resource leak in WASIp1 fd_renumber](https://junglewise.ai/threats/cve-2026-54786-bytecode-alliance-wasmtime-resource-leak-in-wasip1-fd-renumber) (medium, CVSS 5, published 1 Jul 2026) - [CVE-2026-47261: Bytecode Alliance Wasmtime access control bypass in wasmtime-wasi](https://junglewise.ai/threats/cve-2026-47261-bytecode-alliance-wasmtime-access-control-bypass-in-wasmtime-wasi) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2025-53901: RUSTSEC-2025-0046 - Host panic with `fd_renumber` WASIp1 function](https://junglewise.ai/threats/cve-2025-53901-wasmtime-cli-is-vulnerable-to-host-panic-through-its-fd-renumber) (low, CVSS 3.1, published 18 Jul 2025) ## Most severe wasmtime-wasi (crates.io) vulnerabilities - [CVE-2026-47261: Bytecode Alliance Wasmtime access control bypass in wasmtime-wasi](https://junglewise.ai/threats/cve-2026-47261-bytecode-alliance-wasmtime-access-control-bypass-in-wasmtime-wasi) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-58494: Bytecode Alliance Wasmtime improper permission preservation in wasmtime-wasi](https://junglewise.ai/threats/cve-2026-58494-bytecode-alliance-wasmtime-improper-permission-preservation-in) (medium, CVSS 6.5, published 8 Jul 2026) - [CVE-2026-54786: Bytecode Alliance Wasmtime resource leak in WASIp1 fd_renumber](https://junglewise.ai/threats/cve-2026-54786-bytecode-alliance-wasmtime-resource-leak-in-wasip1-fd-renumber) (medium, CVSS 5, published 1 Jul 2026) - [Wasmtime-WASI filesystem sandbox escape with symlink rename](https://junglewise.ai/threats/rustsec-2026-0352-filesystem-sandbox-escape-when-renaming-symlinks-with-86b22c86) (medium, CVSS 4, published 14 Oct 2026) - [wasmtime-wasi excessive memory allocation when guests lack stdio](https://junglewise.ai/threats/rustsec-2026-0322-excessive-allocated-memory-on-the-host-when-guests-84ef0787) (medium, CVSS 4, published 2 Oct 2026) - [Wasmtime wasmtime-wasi fd_readdir information disclosure](https://junglewise.ai/threats/rustsec-2026-0323-fd-readdir-copies-uninitialized-struct-padding-into-ed3c3a69) (medium, CVSS 4, published 2 Oct 2026) - [CVE-2025-53901: RUSTSEC-2025-0046 - Host panic with `fd_renumber` WASIp1 function](https://junglewise.ai/threats/cve-2025-53901-wasmtime-cli-is-vulnerable-to-host-panic-through-its-fd-renumber) (low, CVSS 3.1, published 18 Jul 2025) - [RUSTSEC-2026-0420 - wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving](https://junglewise.ai/threats/rustsec-2026-0420-wasip3-udp-send-can-deliver-a-datagram-to-an-address-cfc65c09) (low, CVSS 3.1, published 29 Oct 2026) - [RUSTSEC-2026-0321 - WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption](https://junglewise.ai/threats/rustsec-2026-0321-wasi-preview-0-implementation-of-poll-oneoff-67c5f6e0) (low, CVSS 3.1, published 2 Oct 2026) - [RUSTSEC-2026-0324 - Guest can panic host through filesystem timestamp before the epoch on wasip3](https://junglewise.ai/threats/rustsec-2026-0324-guest-can-panic-host-through-filesystem-timestamp-681be084) (low, CVSS 3.1, published 2 Oct 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 60% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 4 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "wasmtime-wasi (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/wasmtime-wasi, 9 November 2026.