RUSTSEC-2026-0149
High · 7.5CVSS
7.5
EPSS
—
Published
May 21, 2026
CISA due date
—
The record
WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmtime-wasi | 0 | 24.0.9 |
| crates.io | wasmtime-wasi | 0.0.0-0 | 24.0.9 |
| crates.io | wasmtime-wasi | 25.0.0 | 36.0.10 |
| crates.io | wasmtime-wasi | 37.0.0 | 44.0.2 |