{"action":"Upgrade wasmtime-wasi to 24.0.11 or later.","affected":[{"fixed":"24.0.11","introduced":"0.0.0-0"},{"fixed":"36.0.12","introduced":"25.0.0"},{"fixed":"45.0.3","introduced":"37.0.0"},{"fixed":"46.0.1","introduced":"46.0.0"}],"component":"wasmtime-wasi","cve_ids":["CVE-2026-58494"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["24.0.11","36.0.12","45.0.3","46.0.1"],"ghsa_id":"GHSA-4ch3-9j33-3pmj","id":"tcs_01M5KFBQ6S15YB6X7BT6Z6BTTV","modified_at":"2026-10-12T18:00:14.307573024Z","published_at":"2026-06-24T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0188","https://crates.io/crates/wasmtime-wasi","https://rustsec.org/advisories/RUSTSEC-2026-0188.html","https://github.com/bytecodealliance/wasmtime/pull/13725"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0188","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0188"}],"summary":"WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination"}