Evidence · DiggingBeagle record
CVE-2026-58494: WASI hard link bypass of file permissions
Security advisory for Wasmtime WASI preopen permission bypass and corrected version families.
- Source role
- primary disclosure
Evidence record
Security advisory for Wasmtime WASI preopen permission bypass and corrected version families.
Claim-level citations (1)
- supportsWASI hard links let guests write files declared read-only across preopens: The Wasmtime WASI implementation allowed a guest with directory mutation rights in one preopen to hard-link a source file marked read-only into a writable location and modify its underlying inode.
Description; affected and patched versions