The vulnerability is a filesystem sandbox escape that occurs when Wasmtime’s cap-std dependency incorrectly handles symbolic links that include trailing slashes on macOS and Linux kernels that do not support the openat2 system call. An attacker running a WebAssembly module under wasmtime-wasi can read or write any file on the host filesystem if the module has write access to a sandboxed directory, and even read-only modules can read host files through preexisting symlinks. This flaw is identified as CWE-61 and permits a compromise that extends beyond the intended sandbox boundaries.

Bytecode Alliance’s Wasmtime is affected. All releases before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 are vulnerable when running on macOS or Linux kernels lacking openat2 support. Users deploying these versions in environments where WebAssembly guests have write permissions in the sandboxed directories are at risk.

The CVSS base score is 8.8, which classifies the vulnerability as High severity. The EPSS score is not available, but the lack of a listing in the CISA KEV catalog suggests no publicly known exploitation at this time. However, the attack path requires the ability to supply or execute a malicious Wasmtime-wasi guest; once that is achieved, the exploit can occur locally with no additional network interaction. Because the flaw allows host file access, the risk remains significant, and organizations should act promptly to remediate.