From df92c67925ad2a19ca31df071ac41eb9882ec92c Mon Sep 17 00:00:00 2001 From: Pat Hickey Date: Wed, 24 Jun 2026 12:49:14 -0700 Subject: [PATCH] create rustsec advisory for wasmtime-wasi crate: wasmtime project's GHSA-4ch3-9j33-3pmj --- crates/wasmtime-wasi/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/wasmtime-wasi/RUSTSEC-0000-0000.md diff --git a/crates/wasmtime-wasi/RUSTSEC-0000-0000.md b/crates/wasmtime-wasi/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..4d336a7ed --- /dev/null +++ b/crates/wasmtime-wasi/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "wasmtime-wasi" +date = "2026-06-24" +url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj" +categories = [] +keywords = [] +aliases = ["GHSA-4ch3-9j33-3pmj"] +license = "CC0-1.0" +cvss = "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N" + +[versions] +patched = [">= 46.0.1", ">= 45.0.3, < 46.0.0", ">= 36.0.12, < 37.0.0", ">= 24.0.11, < 25.0.0"] +unaffected = [] +``` + +# WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination + +This is an entry in the RustSec database for the Wasmtime security advisory +located at +https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj +For more information see the GitHub-hosted security advisory.