Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

wasmer-cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.4crates.ioPublished

    Wasmer filesystem sandbox not enforced

    CVE-2023-51661 · GHSA-4mq4-7rw3-vm5j

    Affected
    • crates.io wasmer-cli >= 3.0.0, < 4.2.4
    Fixed in
    4.2.4· Vendor fix available
    Issue
    As of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox. Details https://github.com/wasmerio/wasmer/issues/4267 PoC A minimal Rust program: This should be compiled with cargo build --target wasm32-wasi. The compiled program, when run with wasmer WITHOUT --dir, can still create a file in the working directory. Impact Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem.

    Recommended action: Upgrade to 4.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →