CVE-2026-58494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58494
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-58494.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-58494
Aliases
Downstream
CGA (2)
DEBIAN (1)
JLSEC (1)
MINI (3)
UBUNTU (1)
Published
2026-07-08T20:22:16Z
Modified
2026-10-16T02:55:58Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Details

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-281",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58494.json"
}
References

Affected packages

Git / github.com/bytecodealliance/wasmtime

Affected ranges

Type
GIT
Repo
https://github.com/bytecodealliance/wasmtime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eb160670b724ddce393cdbb2fa380e941bd3e3a6
Introduced
0b195ef5db76c02fb5392ec1418c58bdc5537d41
Fixed
6c0a7fc9c387f34dddcf94ef41d7b3b0f9d18cb0
Introduced
7b3d6ae79e9153a2477668062f5622c10333925f
Fixed
84f1cbebd7e68ad6385f3438b12cf8b8f10d2f08
Introduced
423be7a4e4d30bb377c836d317521d1eb874e157
Fixed
823d1b8f251494a06288194d0df746191f535ff7
Fixed
5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c
Fixed
7db94cdcf0c79cb3dfde884b534b653f2dd83367
Fixed
8a250aac0962ca1364b5f16525720e9d0b39edcd
Fixed
d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "24.0.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "25.0.0"
                },
                {
                    "fixed": "36.0.12"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "37.0.0"
                },
                {
                    "fixed": "45.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "46.0.0"
                },
                {
                    "fixed": "46.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "7db94cdcf0c79cb3dfde884b534b653f2dd83367"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "8a250aac0962ca1364b5f16525720e9d0b39edcd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v24.0.11",
            "range": [
                {
                    "fixed": "eb160670b724ddce393cdbb2fa380e941bd3e3a6"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v36.0.12",
            "range": [
                {
                    "fixed": "6c0a7fc9c387f34dddcf94ef41d7b3b0f9d18cb0"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v45.0.3",
            "range": [
                {
                    "fixed": "84f1cbebd7e68ad6385f3438b12cf8b8f10d2f08"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v46.0.1",
            "range": [
                {
                    "fixed": "823d1b8f251494a06288194d0df746191f535ff7"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

cranelift-v0.*
cranelift-v0.60.0
cranelift-v0.61.0
cranelift-v0.69.0
Other
dev
v0.*
v0.12.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v24.*
v24.0.0
v24.0.1
v24.0.10
v24.0.2
v24.0.3
v24.0.4
v24.0.5
v24.0.6
v24.0.7
v24.0.8
v24.0.9
v36.*
v36.0.0
v36.0.1
v36.0.10
v36.0.11
v36.0.2
v36.0.3
v36.0.4
v36.0.5
v36.0.6
v36.0.7
v36.0.8
v36.0.9
v45.*
v45.0.0
v45.0.1
v45.0.2
v46.*
v46.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-58494.json"