---
id: CVE-2026-47218
title: runwasi facilitates running Wasm and WASI workloads managed by containerd
summary: >-
  runwasi facilitates running Wasm and WASI workloads managed by containerd.
  Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled
  bytes supplied directly in an OCI image layer as a trusted artifact from the
  precompile…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-502
vendor: containerd
product: runwasi
affected:
  - runwasi < 0.6.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:39.257'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47218'
references:
  - url: >-
      https://github.com/containerd/runwasi/commit/d28ab73c2c8a6c50d1927078821bd418b9e51638
    label: security-advisories@github.com
  - url: >-
      https://github.com/containerd/runwasi/releases/tag/containerd-shim-wasmtime/v0.6.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/containerd/runwasi/security/advisories/GHSA-cc25-vq59-rcjx
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-10-15T19:25:46.434Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T19:55:05.544163Z'
---

## Overview

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.