{"id":"CVE-2026-118688","kind":"vulnerability","aliases":["CVE-2026-118688"],"related":[],"title":"Wasmtime WASI: rename lets sandboxed guest reach host directories on macOS and FreeBSD","description":"wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as \"up/\" to move host directories into its sandbox and read or write them.","summary":"Wasmtime's wasi rename path handling re-appends a trailing slash, so renameat follows directory symlinks on macOS and FreeBSD hosts. A guest with write access to its sandbox can move host directories into it and read or write them.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freebsd","macos","package","rust","wasi","wasmtime"],"not_affected_if":["linux-only-host","no-writable-preopens","trusted-guest-code"],"how_to_check":"- Check the Wasmtime version in use with `wasmtime --version` or the wasmtime-wasi crate version in `Cargo.lock`\n- Confirm the host OS is macOS or FreeBSD; Linux is not described as affected","fix":"- Upgrade wasmtime-wasi to `36.0.18`, `48.0.6`, or `49.0.3` depending on release line\n- Rebuild and redeploy any embedder that bundles wasmtime-wasi","status":"open","published_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:56+00:00","triaged_at":"2026-10-28T19:35:42+00:00","updated_at":"2026-10-28T19:35:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T19:35:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade wasmtime-wasi to `36.0.18`, `48.0.6`, or `49.0.3` depending on release line\n- Rebuild and redeploy any embedder that bundles wasmtime-wasi","reach":"local","title":"Wasmtime WASI: rename lets sandboxed guest reach host directories on macOS and FreeBSD","impact":"high","summary":"Wasmtime's wasi rename path handling re-appends a trailing slash, so renameat follows directory symlinks on macOS and FreeBSD hosts. A guest with write access to its sandbox can move host directories into it and read or write them.","category":"package","nicknames":[],"who_cares":["wasmtime","wasi","rust","macos","freebsd"],"confidence":0.7,"needs_auth":"no","worst_case":"Guest reads or writes host directories outside its sandbox.","analyst_note":"","how_to_check":"- Check the Wasmtime version in use with `wasmtime --version` or the wasmtime-wasi crate version in `Cargo.lock`\n- Confirm the host OS is macOS or FreeBSD; Linux is not described as affected","needs_analyst":false,"not_affected_if":["linux-only-host","no-writable-preopens","trusted-guest-code"],"who_is_affected":"Applications that embed Wasmtime and give untrusted guest code preopened directories with write access, running on macOS or FreeBSD hosts. Sandboxes that run only trusted code, or have no writable preopened directories, have less exposure. Linux hosts are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3388,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118688':16A,19A '-2026':15A,18A '36.0.18':72C '37.0.0':73C '48.0.6':75C '49.0.0':77C '49.0.3':79C 'access':52B,106C 'append':34B,82C 'caus':90C 'cve':14A,17A 'directori':9A,41B,59B,99C,118C 'follow':40B,98C 'freebsd':13A,20B,46B,95C 'guest':6A,49B,102C 'handl':31B 'host':8A,47B,58B,96C,117C 'let':4A 'maco':11A,21B,44B,93C 'move':57B,116C 'packag':22B 'path':30B,89C 're':33B,81C 're-append':32B,80C 'reach':7A 'read':63B,123C 'relat':110C 'renam':3A,29B,87C,108C 'renameat':39B,91C 'rust':23B 'sandbox':5A,55B,104C,121C 'slash':37B,85C 'sourc':88C 'symlink':42B,100C,111C 'trail':36B,84C 'wasi':2A,24B,28B,68C 'wasmtim':1A,25B,26B,67C,70C 'wasmtime-wasi':66C 'write':51B,65B,105C,125C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Wasmtime and give untrusted guest code preopened directories with write access, running on macOS or FreeBSD hosts. Sandboxes that run only trusted code, or have no writable preopened directories, have less exposure. Linux hosts are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118688","severity":null,"published_at":"2026-10-28T19:17:35+00:00","modified_at":"2026-10-28T19:17:36+00:00","first_seen_at":"2026-10-28T19:34:56+00:00","fetched_at":"2026-10-28T19:34:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}