Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
bytecodealliance/wasmtime
main @ 946f763
17
Fixes
40
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Memory Corruption: 5 prior fixes. Scrutinize any change in this area.
cranelift: most-fixed (5 issues). Treat as high-risk during review.
14 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Miscompilations in SSA-value tracking and missing stack maps during GC-triggering loops (like array copy operations) leave live references untracked, resulting in critical use-after-free vulnerabilities. This directly undermines the WebAssembly sandbox isolation.
Memory Corruption: Inaccurate alias analysis optimizations can lead to store-to-load forwarding of stale values or incorrect instruction reordering around VMContext structures. This allows compiled guest code to bypass runtime memory bounds checks.
Auth Bypass: Inadequate enforcement of directory boundaries within WASI host filesystem calls allows guests to bypass directory containment, such as linking or renaming files across distinct read-only and read-write permission domains.