-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete validation of Windows device filenames in cap-std's sandboxing logic. The linked PR #371 in cap-std explicitly adds missing superscript digit checks. The functions handling path validation and file opening would be the primary locations for this logic. The 'Dir::open' method is the entry point for filesystem operations, while 'is_reserved_device_name' would contain the actual pattern matching. Both would need to be updated to cover superscript digits, as shown in the commit diff adding these checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wasmtime | rust | < 24.0.2 | 24.0.2 |
| wasmtime | rust | >= 25.0.0, < 25.0.3 | 25.0.3 |
| wasmtime | rust | = 26.0.0 | 26.0.1 |
Ongoing coverage of React2Shell