CVE-2024-38358

Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22

• https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662
• https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5
• https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662
• https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5

Published

Jun 19, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38352Rejected reason: CVE was assigned in error.
• CVE-2024-38353CodiMD allows realtime collaborative markdown notes on all p…5.3
• CVE-2024-38354CodiMD allows realtime collaborative markdown notes on all p…6.1
• CVE-2024-38355Socket.IO is an open source, real-time, bidirectional, event…7.3
• CVE-2024-38356TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38357TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38359The Lightning Network Daemon (lnd) - is a complete implement…6.5
• CVE-2024-38360Discourse is an open source platform for community discussio…4.9
• CVE-2024-38361Spicedb is an Open Source, Google Zanzibar-inspired permissi…5.3
• CVE-2024-38363Airbyte is a data integration platform for ELT pipelines. Ai…8.5
• CVE-2024-38364DSpace is an open source software is a turnkey repository ap…2.6
• CVE-2024-38365btcd is an alternative full node bitcoin implementation writ…8.1