{"action":"Upgrade wasmtime-wasi to 24.0.11 or later.","affected":[{"fixed":"24.0.11","introduced":"0"},{"fixed":"36.0.12","introduced":"25.0.0"},{"fixed":"45.0.3","introduced":"37.0.0"},{"fixed":"46.0.1","introduced":"46.0.0"}],"component":"wasmtime-wasi","cve_ids":["CVE-2026-58494"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["24.0.11","36.0.12","45.0.3","46.0.1"],"ghsa_id":"GHSA-4ch3-9j33-3pmj","id":"tcs_01M5JHHTA3CZBYRGH944YAADT2","modified_at":"2026-10-16T20:15:03.597563841Z","published_at":"2026-10-16T19:57:26Z","references":["https://osv.dev/vulnerability/GHSA-4ch3-9j33-3pmj","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj","https://nvd.nist.gov/vuln/detail/CVE-2026-58494","https://github.com/bytecodealliance/wasmtime/pull/13725","https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c","https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367","https://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd","https://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11","https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12","https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3","https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1","https://rustsec.org/advisories/RUSTSEC-2026-0188.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-4ch3-9j33-3pmj","url":"https://osv.dev/vulnerability/GHSA-4ch3-9j33-3pmj"}],"summary":"Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination"}