JLSEC-2026-1366

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1366.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1366.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-1366

Upstream

CVE-2026-47261

EUVD-2026-37001

GHSA-2r75-cxrj-cmph

Published

2026-08-21T20:43:33.133Z

Modified

2026-08-21T21:14:20.305686649Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Details

Summary

In wasmtime-wasi, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this wasmtime-wasi enforced access control mechanism can be bypassed by using the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with OpenFlags::TRUNCATE oflag only, for example:

dir_descriptor.open_at(
   PathFlags::empty(),
   FILENAME,
   OpenFlags::TRUNCATE,
   DescriptorFlags::READ,
)

wasip1::path_open(
    dir_fd,
    0,
    FILENAME,
    wasip1::OFLAGS_TRUNC,
    wasip1::RIGHTS_FD_READ,
    0,
    0
)

The root cause is that the clause that considered OpenFlags::TRUNCATE did not set open_mode |= OpenMode::WRITE;, used later in that function for the access control check against FilePerms for whether opening that file is permitted. With the bug corrected, these calls to open-at and path_open fail with error-code.not-permitted and ERRNO_PERM respectively.

The bug in crates/wasi/src/filesystem.rs, Dir::open_at, lines 967–969:

if oflags.contains(OpenFlags::TRUNCATE) {
    opts.truncate(true).write(true);
}

and the single line fix is:

if oflags.contains(OpenFlags::TRUNCATE) {
    opts.truncate(true).write(true);
    open_mode |= OpenMode::WRITE;
}

Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the WasiCtxBuilder:

builder.preopened_dir("readonly", "readonly", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);

In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens.

Database specific

{
    "sources": [
        {
            "imported": "2026-08-21T20:09:02.079Z",
            "published": "2026-06-15T21:17:11.153Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-47261",
            "database_specific": {
                "status": "Analyzed"
            },
            "id": "CVE-2026-47261",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47261",
            "affected": {
                "bytecodealliance:wasmtime": [
                    "< 24.0.9",
                    ">= 25.0.0, < 36.0.10",
                    ">= 37.0.0, < 44.0.2"
                ]
            },
            "modified": "2026-06-17T16:42:08.350Z"
        },
        {
            "imported": "2026-08-21T20:09:14.548Z",
            "published": "2026-06-05T15:47:02Z",
            "url": "https://api.github.com/advisories/GHSA-2r75-cxrj-cmph",
            "html_url": "https://github.com/advisories/GHSA-2r75-cxrj-cmph",
            "id": "GHSA-2r75-cxrj-cmph",
            "modified": "2026-07-08T17:35:44Z"
        },
        {
            "imported": "2026-08-21T20:09:03.342Z",
            "published": "2026-06-15T19:47:40Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-37001",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37001",
            "affected": {
                "bytecodealliance:wasmtime": [
                    "25.0.0, < 36.0.10",
                    "37.0.0, < 44.0.2",
                    "< 24.0.9"
                ]
            },
            "id": "EUVD-2026-37001",
            "modified": "2026-06-16T12:46:04Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Credits

- shumbo - FINDER
- - https://github.com/shumbo

Affected packages

Julia / Wasmtime_jll

Package

Name: Wasmtime_jll
Purl: pkg:julia/Wasmtime_jll?uuid=d20e7296-4f3e-515c-90b9-d2595a77bf72

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

45.0.1+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1366.json"