External risk intelligence

Runwasi Wasmtime Native Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-47218

The vulnerability exists within the containerd-shim-wasmtime component used for managing Wasm workloads. It requires an attacker to successfully cause a victim to run a specifically crafted container image. While container runtimes operate in various environments, they are typically internal infrastructure components rather than public-facing services directly exposed to the internet.

Deserialization

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a flaw in runwasi, a component that facilitates running WebAssembly workloads within containerd. The issue allows a specially crafted image to bypass security validation, enabling the execution of native code within the workload container's environment. This could potentially grant unauthorized access to filesystem, credentials, and networking resources available to that container.

Unvalidated code can escape container sandbox.
Confirms runwasi can execute unintended native code.
Assess relevance for containerized Wasm workloads.

Attack Path

How an attacker could exploit the issue

An attacker could craft a container image containing malicious WebAssembly code that bypasses security checks. When a victim runs this image using a vulnerable version of runwasi, the code can be deserialized as trusted native code, allowing it to execute with the privileges of the container. This grants the attacker access to the container's filesystem, environment variables, credentials, and network.

Requires victim to run crafted image.
Bypasses WebAssembly validation.
Allows native code execution within container.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a crafted container image could trick the Wasmtime runtime into treating precompiled WebAssembly bytes as trusted native code. This could allow an attacker to bypass WebAssembly validation and execute code within the shim zygote process, potentially gaining access to the workload container's filesystem, environment variables, credentials, and network access.

Workload container filesystem and network.
By tricking Wasmtime into trusting crafted bytes.
Unauthorized access to container resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `runwasi` component, used by containerd to manage WebAssembly workloads, is affected by a vulnerability that allows a crafted OCI image to bypass WebAssembly validation and execute native code. This impacts teams responsible for containerized application deployments, potentially including platform, infrastructure, and application owners. The first step is to identify all instances of `runwasi` and associated containerd configurations, determine their exposure, and confirm the accountable owner for remediation.

Confirm `runwasi` deployment and impact.
Identify accountable platform or application owners.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is runwasi and its role in container management?

Runwasi is a software component that allows developers to run WebAssembly (Wasm) and WASI workloads inside containerd, a standard industry tool for managing container lifecycles. By acting as a shim, it enables container runtimes to execute Wasm modules as if they were traditional container processes, integrating them into existing cloud-native infrastructure.

What does CWE-502 mean in the context of CVE-2026-47218?

CWE-502 refers to the deserialization of untrusted data. In this vulnerability, the system incorrectly trusts precompiled Wasm bytes found in a container image, treating them as safe native code. Instead of validating the code, the system deserializes it, allowing malicious data to execute as instructions on the processor, effectively skipping the security layers intended to keep Wasm workloads contained.

How is this vulnerability triggered?

An attacker triggers this by providing a crafted container image that contains malicious precompiled bytes. The vulnerability is exploited only when a victim is convinced to run this specific image. It does not trigger if you are running standard, verified container images, as the flaw relies on the shim mistakenly identifying manipulated artifacts as trusted code from a precompile-cache path.

Do I need to worry about CVE-2026-47218 for my internal services?

Halo Surface Signal indicates that while the risk depends on your specific environment, the affected component is typically used for internal infrastructure rather than being directly exposed to the internet. However, because it runs within containerd, any service using untrusted or externally sourced container images should be evaluated for potential impact, regardless of its network location.

What are the first steps for patching my environment?

Start by identifying all deployments using runwasi or the containerd-shim-wasmtime-v1 component. Once identified, upgrade these components to version 0.6.1 or newer, as this release addresses the flawed trust logic. Ensure you also check any downstream shims that rely on the precompile-cache API, as these may require independent updates beyond the core fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.