Login Request a demo
Medium severity · published May 15, 2025
CVE-2025-43853
iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wasm-micro-runtime · bytecodealliance
< 2.3.0 · source: vendor
WM
Webassembly Micro Runtime · Bytecodealliance
before 2.2.0 · source: NVD
Affected product
WA
wasm-micro-runtime
bytecodealliance
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43853
Patch
https://github.com/bytecodealliance/wasm-micro-runtime/commit/28702edaf739cdeee54e81efe5868bf00724c33c
Exploit
https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-8fc8-4g25-c8m7
More from wasm-micro-runtime
7.4
CVE-2025-64713
WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode
5.5
CVE-2025-64704
WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
5.3
CVE-2025-58749
WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode
5.3
CVE-2025-54126
WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified