Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47218— runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

Quick assessment

Affected
containerd runwasi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

runwasi 支持由 containerd 管理的 WebAssembly (Wasm) 和 WASI 工作负载的运行。在版本 0.6.1 之前，containerd-shim-wasmtime-v1 会将直接嵌入在 OCI 镜像层中的 Wasmtime 预编译字节码，错误地视为来自预编译缓存路径的信任性组件，并将其反序列化为原生代码执行。攻击者若诱导受害者运行精心构造的镜像，即可绕过 WebAssembly 验证机制，在 shim 的 zygote 进程中执行原生代码，从而获得该工作负载容器所拥有的文件系统、环

CVSS 9.3 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
containerd runwasi < 0.6.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47218

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
Source: CVE Program / CVE List V5
Vulnerability Description
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
containerd runwasi < 0.6.1 -

II. Public POCs for CVE-2026-47218

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47218

请登录查看更多情报信息。

Other References for CVE-2026-47218 (3)

IV. Related Vulnerabilities

Same vendor: containerd
Same weakness: CWE-502

V. Comments for CVE-2026-47218

No comments yet

Leave a comment