CVE-2026-47218
9.3CriticalPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Attackers can bypass the WebAssembly sandbox and execute arbitrary native code inside the container environment. They need to convince the system to run a malicious, crafted OCI container image.
Root cause
The runtime insecurely deserializes untrusted precompiled Wasmtime bytecode from OCI image layers as native code instead of treating it as untrusted input.
Affected systems
containerd-shim-wasmtime-v1 prior to 0.6.1; downstream shims implementing Compiler via containerd-shim-wasm precompile-cache API are also affected.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade containerd-shim-wasmtime to version 0.6.1 or newer. If you cannot patch immediately, block or avoid running untrusted or unverified Wasm container images.
$ containerd-shim-wasmtime-v1 --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.