High priorityDisclosed

Advisory · CVE-2026-118688

Wasmtime sandbox escape via symlink rename on macOS and FreeBSD hosts

A Wasmtime guest with sandbox write access can move host directories into its sandbox by renaming a relative symlink, escaping the sandbox on macOS and FreeBSD hosts. Rated 8.8 on CVSS 4.0.

Advisory published October 28, 2026Independent summary
Vendor
Bytecode Alliance
Product
Wasmtime
Identifier / CWE
CVE-2026-118688
CWE-61
Action timing
Immediate
ELI5

Explain it like I’m five

The sandbox is supposed to keep the guest in its own room, but renaming a shortcut drags a host folder into the room. The guest can then read and write the host's files.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sandbox write access

    A guest holds sandbox write access on a macOS or FreeBSD host.

  2. 02Symlink rename

    The guest renames a relative symlink, and the runtime re-appends a trailing slash so the host rename call follows directory symlinks.

  3. 03Host directory moved

    Host directories are moved into the guest sandbox and become readable and writable by the guest.

What happened

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink to move host directories into its sandbox and read or write them. The CVSS 4.0 score is 8.8.

The flaw is host-OS specific: macOS and FreeBSD rename semantics are what turn the trailing slash into symlink following, so Linux hosts are not described as affected in the record.

What to do

  1. Inventory Wasmtime deployments on macOS and FreeBSD hosts running untrusted guests.
  2. Upgrade to 36.0.18, 48.0.6, or 49.0.3 on the matching release line.
  3. Limit guest write access and untrusted workloads until patched.
  4. Review host filesystems for unexpected moved directories.
  5. Confirm the deployed version after patching.

Management note

A sandbox escape in a WebAssembly runtime breaks the core isolation promise for anyone running untrusted guests. macOS and FreeBSD hosts running such workloads should patch first.