runwasi, a component that enables containerd to run WebAssembly and WASI workloads, has a critical deserialization flaw (CWE-502). Prior to version 0.6.1, the shim interpreted Wasmtime precompiled bytecode supplied in an OCI image layer as trusted data from a local cache and executed it as native code. An attacker who can get a victim to run a crafted image can bypass WebAssembly validation, inject malicious native code, and gain full filesystem, environment, credential, networking, and syscall access within the workload container. The vulnerability escapes the intended WASI sandbox but still requires the victim to launch the tampered image, and it does not directly break container isolation or provide host code execution on its own.

The flaw affects the containerd-runwasi shim, specifically containerd-shim-wasmtime-v1 prior to release 0.6.1. Any downstream shim that adopts runwasi’s precompile‑cache API and trusts executable artifacts from OCI image layers is also vulnerable, even if the downstream product is not the original containerd variant. Versions 0.6.1 and later of containerd-shim-wasmtime are free of this defect, while earlier releases remain at risk.

The CVSS v3 score of 9.3 marks this as a critical vulnerability, and the EPSS score of less than 1% indicates that while exploitation is possible, it is unlikely to be widespread. This issue is not listed in CISA’s KEV catalog. Attackers would need the ability to push a malicious OCI image to a vulnerable system, but once that is achieved, the ability to execute arbitrary native code inside the shim can be leveraged to compromise the workload container. The lack of direct host impact limits the overall scope compared to full host escalation vulnerabilities, yet the impact within containers is severe.