Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
211 results · page 3 of 5
Jun 4, 2025Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2025-48888 · Other software · denoland · reported by GitHubMedium 5.5
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read --deny-read main.ts` results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions given as `--allow-* --deny-*`. This only affects a nonsensical combination of flags, so there shouldn't be a real impact on the userbase. Users may upgrade to version 2.1.13, 2.2.13, or 2.3.2 to receive a patch.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2025-24015 · Other software · denoland · reported by GitHubHigh 7.7
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective. Version 2.1.7 includes a patch that addresses this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and commCVE-2025-43853 · Other software · bytecodealliance · reported by GitHubHigh 7
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
- Product
- wasm-micro-runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36.CVE-2025-3122 · Other software · WebAssembly · reported by VulDBLow 2.3
A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025A vulnerability was found in WebAssembly wabt 1.0.36.CVE-2025-2584 · Other software · WebAssembly · reported by VulDBLow 2.3
A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical.CVE-2025-2368 · Other software · WebAssembly · reported by VulDBMedium 5.3
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP.CVE-2025-29776 · Other software · demergent-labs · reported by GitHubHigh 8.7
Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will occur with any valid invocation of `setTimer`. The problem has been fixed as of Azle version `0.30.0`. As a workaround, if a canister is caught in this infinite loop after calling `setTimer`, the canister can be upgraded and the timers will all be cleared, thus ending the loop.
- Product
- azle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025A bug in WebAssembly code generation could have lead to a crash.CVE-2025-1011 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jan 6, 2025Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2025-21620 · Other software · denoland · reported by GitHubHigh 7.5
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.CVE-2024-27532 · Other software · bytecodealliance · reported by MITREHigh 7.5
wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.
- Product
- webassembly_micro_runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 8, 2024An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file CVE-2024-25431 · Other software · bytecodealliance · reported by MITREHigh 7.8
An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.
- Product
- webassembly_micro_runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 5, 2024Wasmtime is a fast and secure runtime for WebAssembly.CVE-2024-51745 · Other software · bytecodealliance · reported by GitHubLow 2.3
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions. There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Oct 11, 2024Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2024-9859 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Wasmtime is an open source runtime for WebAssembly.CVE-2024-47813 · Other software · bytecodealliance · reported by GitHubLow 2.9
Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption could, following an additional and particular sequence of concurrent events, lead to violations of WebAssembly's control-flow integrity (CFI) and type safety. Users that do not use `wasmtime::Engine` across multiple threads are not affected. Users that only create new modules across threads over time are additionally not affected. Reproducing this bug requires creating and dropping multiple type instances (such as `wasmtime::FuncType` or `wasmtime::ArrayType`) concurrently on multiple threads, where all types are associated with the same `wasmtime::Engine`. **Wasm guests cannot trigger this bug.** See the "References" section below for a list of Wasmtime types-related APIs that are affected. Wasmtime maintains an internal registry of types within a `wasmtime::Engine` and an engine is shareable across threads. Types can be created and referenced through creation of a `wasmtime::Module`, creat
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Wasmtime is an open source runtime for WebAssembly.CVE-2024-47763 · Other software · bytecodealliance · reported by GitHubMedium 5.5
Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when Wasmtime is compiled with Rust 1.81 and later. WebAssembly tail calls are a proposal which relatively recently reached stage 4 in the standardization process. Wasmtime first enabled support for tail calls by default in Wasmtime 21.0.0, although that release contained a bug where it was only on-by-default for some configurations. In Wasmtime 22.0.0 tail calls were enabled by default for all configurations. The specific crash happens when an exported function in a WebAssembly module (or component) performs a `return_call` (or `return_call_indirect` or `return_call_ref`) to an imported host function which captures a stack trace (for example, the host function raises a trap). In this situation, the stack-walking code previously assumed there was always at least one WebAssembly frame on the stack but with tail calls that is no longer true. With the t
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.CVE-2023-39333 · Other software · NodeJS · reported by support@hackerone.comMedium 5.3
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgsecurity.netapp.com
Sep 3, 2024Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads.CVE-2024-45389 · Other software · CloudCannon · reported by GitHubMedium 6.4
Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of `document.currentScript.src`. Prior to Pagefind version 1.1.1, it is possible to "clobber" this lookup with otherwise benign HTML on the page. This will cause `document.currentScript.src` to resolve as an external domain, which will then be used by Pagefind to load dependencies. This exploit would only work in the case that an attacker could inject HTML to a live, hosted, website. In these cases, this would act as a way to escalate the privilege available to an attacker. This assumes they have the ability to add some elements to the page (for example, `img` tags with a `name` attribute), but not others, as adding a `script` to the page would itself be the cross-site scripting vector. Pagefind has tightened this resolution in version 1.1.1 by ensuring the source is loaded from a valid script element. There are no reports of this being exploited in the wild via Pagefind.
- Product
- pagefind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Incomplete WebAssembly exception handing could have led to a use-after-free.CVE-2024-7521 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 6, 2024A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.CVE-2024-7520 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 2, 2024Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.CVE-2024-32673 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.7
Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue. This issue affects Walrus: before 72c7230f32a0b791355bbdfc78669701024b0956.
- Product
- Walrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024Spin is the developer tool for building and running serverless applications powered by WebAssembly.CVE-2024-32980 · Other software · fermyon · reported by GitHubCritical 9.1
Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.
- Product
- spin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-34346 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with `--allow-read` or `--allow-write` may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit `--allow-all` access to read or write `/etc`, `/dev` on unix platform (as well as `/proc` and `/sys` on linux platforms), and any path starting with `\\` on Windows.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-32477 · Other software · denoland · reported by GitHubHigh 7.7
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFLUSH)` and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the user input. Some ANSI escape sequences act as a info request to the master terminal emulator and the terminal emulator sends back the reply in the PTY channel. standard streams also use this channel to send and get data. For example the `\033[6n` sequence requests the current cursor position. These sequences allow us to append data to the standard input of Deno. This vulnerability allows an attacker to bypass Deno permission policy. This vulnerability is fixed in 1.42.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML pCVE-2024-3833 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Apr 4, 2024wasmtime is a runtime for WebAssembly.CVE-2024-30266 · Other software · bytecodealliance · reported by GitHubLow 3.3
wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2024-2887 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.7
Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Mar 23, 2024In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm).CVE-2024-30161 · Other software · QT · reported by MITREMedium 6.5
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Product
- QT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgcodereview.qt-project.org
Mar 20, 2024Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems.CVE-2024-28123 · Other software · wasmi-labs · reported by GitHubHigh 7.3
Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.
- Product
- wasmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27936 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27935 · Other software · denoland · reported by GitHubHigh 7.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27934 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27933 · Other software · denoland · reported by GitHubHigh 8.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together. Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27932 · Other software · denoland · reported by GitHubMedium 4.6
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27931 · Other software · denoland · reported by GitHubMedium 5.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2023Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly CVE-2023-52284 · Other software · Bytecodealliance · reported by MITREMedium 5.5
Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.
- Product
- Webassembly Micro Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser.CVE-2023-51661 · Other software · wasmerio · reported by GitHubHigh 8.4
Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.
- Product
- wasmer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasmCVE-2023-48105 · Other software · Bytecodealliance · reported by MITREHigh 7.5
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
- Product
- Webassembly Micro Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.CVE-2023-46331 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.CVE-2023-46332 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Wasmtime is a standalone runtime for WebAssembly.CVE-2023-41880 · Other software · bytecodealliance · reported by GitHubLow 2.2
Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result. This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless. This issue was discovered through fuzzing of Wasmtime's code generator Cranelift. Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. T
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26.CVE-2020-18382 · Other software · Webassembly · reported by MITREMedium 6.5
Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26.CVE-2020-18378 · Other software · Webassembly · reported by MITREMedium 6.5
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
- Product
- Binaryen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").CVE-2023-31669 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 22, 2023An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crCVE-2023-31670 · Other software · Webassembly · reported by MITREHigh 7.5
An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.
- Product
- Webassembly Binary Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.CVE-2023-30300 · Other software · W3 · reported by MITREMedium 5.5
An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Apr 27, 2023Wasmtime is a standalone runtime for WebAssembly.CVE-2023-30624 · Other software · bytecodealliance · reported by GitHubLow 3.9
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be optimized away. Vulnerable versions of Wasmtime compiled with Rust 1.70, which is currently in beta, or later are known to have incorrectly compiled functions. Versions of Wasmtime compiled with the current Rust stable release, 1.69, and prior are not known at this time to have any issues, but can theoretically exhibit potential issues. The underlying problem is that Wasmtime's runtime state for an instance involves a Rust-defined structure called `Instance` which has a trailing `VMContext` structure after it. This `VMContext` structure has a runtime-defined layout that is unique per-module. This representation cannot be expressed with safe code in Rust so `unsafe` code is required to maintain this state. The code doing this, however, has methods which take `&self` as an argument but modify data in the `VMCon
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.CVE-2023-27119 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.
- Product
- Wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.CVE-2023-27117 · Other software · Webassembly · reported by MITREHigh 7.8
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.CVE-2023-27116 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 9, 2023WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.CVE-2023-27115 · Other software · Webassembly · reported by MITREMedium 5.5
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.
- Product
- Webassembly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.