CVE-2023-51661

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
wasmerio	wasmer	>= 3.0.0, < 4.2.4

References

https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3cPatch
https://github.com/wasmerio/wasmer/issues/4267Issue Tracking
https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5jExploit, Vendor Advisory
https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3cPatch
https://github.com/wasmerio/wasmer/issues/4267Issue Tracking
https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5jExploit, Vendor Advisory

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-516627.5The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake CVE-2023-516635.3Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic dat CVE-2023-516649.8tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow CVE-2023-516657.5Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-s CVE-2023-516665.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored CVE-2023-516678.2Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Co CVE-2023-516688.8Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPres CVE-2023-516695.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooComme CVE-2023-51675.4The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, w CVE-2023-516704.3Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.CVE-2023-516715.4Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.CVE-2023-516727.5Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.