{"action":"Upgrade wasmtime to 0.30.0 or later.","affected":[{"fixed":"0.30.0","introduced":"0"}],"component":"wasmtime","cve_ids":["CVE-2021-39216","CVE-2021-39218","CVE-2021-39219"],"ecosystem":"PyPI","epss":0.00307,"exploited":false,"fixed_versions":["0.30.0"],"ghsa_id":"GHSA-4873-36h9-wv49","id":"tcs_01M5KGCBCHEYC5A48V22KV6QR5","modified_at":"2024-03-15T00:05:20.369060Z","published_at":"2021-09-17T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-320","https://crates.io/crates/wasmtime","https://github.com/bytecodealliance/wasmtime/commit/101998733b74624cbd348a2366d05760b40181f3","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-320","url":"https://osv.dev/vulnerability/PYSEC-2021-320"}],"summary":"Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Was"}