CVE-2023-51661

Public Exploit
Filesystem sandbox not enforced in wasmer-cli

Description

Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.

Category

8.4
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.27%
Vendor Advisory github.com
Affected: wasmerio wasmer
Published at:
Updated at:

References

Link Tags
https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j vendor advisory exploit
https://github.com/wasmerio/wasmer/issues/4267 issue tracking
https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c patch

Frequently Asked Questions

What is the severity of CVE-2023-51661?
CVE-2023-51661 has been scored as a high severity vulnerability.
How to fix CVE-2023-51661?
To fix CVE-2023-51661, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-51661 being actively exploited in the wild?
It is possible that CVE-2023-51661 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-51661?
CVE-2023-51661 affects wasmerio wasmer.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.