Skip to content
Rush Commerce
Software & Dev2 min read

Wasmtime sandbox escape flaws: rebuild every embedded copy

Two CVSS 9.9 Wasmtime Cranelift bugs let a malicious WebAssembly module escape the sandbox. Upgrade to 36.0.19, 48.0.7, 49.0.4, or 50.0.0 and rebuild.

If you run code you didn't write inside a WebAssembly sandbox, check your Wasmtime version today. The Bytecode Alliance published two critical Wasmtime sandbox escape flaws, both rated CVSS 9.9, in its Cranelift compiler. A malicious Wasm module can break out of the box it was supposed to stay in. Fixed releases shipped October 19 and 20, and The Hacker News brought wider attention to them on October 26.

What actually happened

From the project's GitHub advisories:

  • CVE-2026-115889 (all architectures): Cranelift packed value indices into bit fields that could overflow silently. A very large or crafted function makes the compiler emit wrong machine code. Affects versions before 36.0.19 and 37.0.0 through 42.x. Wasmtime 43 changed the code in March, but nobody flagged it as a security fix at the time.
  • CVE-2026-115893 (ARM64 only): A br_table with roughly 256,000+ targets makes the aarch64 backend jump to the wrong place. Affects everything before 36.0.19, 48.0.7, and 49.0.4. The bug dates to 2020.
  • Fixed in: 36.0.19, 48.0.7, 49.0.4, and 50.0.0. The old 24.x LTS line is out of support and gets no fix.
  • No workaround. No attacks have been reported.

One catch: as of today, GitHub's advisory database has a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893. Dependabot won't alert you about the ARM64 bug. cargo audit will, through RustSec.

Why the Wasmtime sandbox escape matters for your business

Wasm is the sandbox people use for untrusted code. Plugin systems, edge functions, customer scripts, and AI agents that write and run code often rely on a Wasm runtime as the wall. These bugs put a hole in that wall.

ARM64 is the cheap box you picked. Graviton instances, Ampere hosts, and Apple Silicon dev machines are all aarch64. Those are the hosts hit by the bug that Dependabot won't alert you to.

Updating the CLI fixes nothing. Wasmtime is usually a library. Every service that embeds it, including the wasmtime crate, Spin (fixed in 4.2.4), and Python or Go bindings, needs a rebuild against a fixed version and a redeploy.

Key takeaways

  • Two CVSS 9.9 Cranelift bugs allow Wasm sandbox escape; no workaround exists
  • Upgrade to 36.0.19, 48.0.7, 49.0.4, or 50.0.0, then rebuild every binary that embeds Wasmtime
  • ARM64 hosts need the fix even on 43.x through 47.x
  • Dependabot misses CVE-2026-115893; run cargo audit or check Cargo.lock by hand
  • If you're still on 24.x LTS, you're on your own; move now

Running untrusted code is a design decision, not a default. We build sandboxed plugin and agent runtimes with layered isolation, pinned dependencies, and an audit step in CI, so one runtime bug doesn't reach your customer data. See how we build it, or ask us to audit what you run today.

Sources: Wasmtime advisory GHSA-897f-g5gm-fmxm, Wasmtime advisory GHSA-mghf-wjfp-p5xm, The Hacker News.

  • #wasmtime
  • #webassembly
  • #security
  • #sandboxing
  • #rust
TR

Tommy Rush — Founder, Rush Commerce

Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More

Get The Rush Report weekly — one email, zero fluff.

Keep reading

Software & Dev3 min read

Tailworm: unpatched Tailscale SSH flaws. Tighten your ACLs now.

A researcher says Tailscale SSH forwarding lets one hacked device get root on others. No patch yet. Use per-pair ACLs and turn off SSH port forwarding.

Read it
Software & Dev3 min read

LiteLLM root cause: a leaked key was force-pushed, not revoked

LiteLLM's attack began with a master key leaked in May and never revoked. A force-push hides a secret but does not kill it. Rotate first, then clean up.

Read it