CVE-2026-47218

Awaiting Analysis Awaiting Analysis - Queue

Code Execution via Precompiled Wasmtime Artifacts in runwasi

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-47218

EUVD

EUVD-2026-102247

Affected Vendors & Products

Vendor	Product	Version / Range
containerd	runwasi	< 0.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability affects runwasi's Wasmtime shim (containerd-shim-wasmtime) versions up to v0.6.0. It allows an attacker to bypass the WASI sandbox by supplying a forged Wasmtime precompiled artifact directly as an OCI image layer. Normally, precompiled artifacts should only be loaded from a trusted local cache, not from untrusted image content. By exploiting this, an attacker can cause the shim to deserialize and execute attacker-controlled native code instead of compiling and validating WebAssembly.

Detection Guidance

Detecting this vulnerability requires checking if your system is running vulnerable versions of containerd-shim-wasmtime (v0.6.0 or earlier). Use commands like 'crictl ps' to inspect running shims and 'docker inspect <container>' to check image layers for precompiled Wasmtime artifacts. Review logs for deserialization errors or unexpected native code execution in shim processes.

Impact Analysis

An attacker who causes a victim to run a crafted image can execute native code in the shim zygote process, gaining filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. This escapes the WASI sandbox to the workload container boundary but does not bypass container isolation or provide direct host code execution.

Compliance Impact

This vulnerability allows execution of native code within the shim zygote process by bypassing WebAssembly validation, potentially granting unauthorized access to filesystem, environment, credentials, networking, and Linux syscalls. This could lead to data exfiltration or unauthorized modifications, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade to containerd-shim-wasmtime v0.6.1 or later immediately. Disable or restrict OCI image layers containing precompiled Wasmtime artifacts. Audit all Wasm workloads for suspicious activity. Monitor shim processes for unauthorized native code execution or sandbox escapes.

Hi! I’m here to help you understand CVE-2026-47218. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70