---
title: Tip: find every embedded copy of Wasmtime before you call the sandbox escapes patched | ctxsec
url: https://ctxsec.com/items/tip-find-embedded-wasmtime-upgrade
description: ""
status: "guidance based on Wasmtime advisories GHSA-897f-g5gm-fmxm / GHSA-mghf-wjfp-p5xm"
published: 2026-10-23
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-find-embedded-wasmtime-upgrade.md)

guidance based on Wasmtime advisories GHSA-897f-g5gm-fmxm / GHSA-mghf-wjfp-p5xm

2026-10-23

### Tip: find every embedded copy of Wasmtime before you call the sandbox escapes patched

Wasmtime usually ships inside other software (proxies, plugin hosts, serverless runtimes, agent tool sandboxes), not as a standalone install. To check:

- Rust projects: `cargo tree -i wasmtime`, then confirm the version is 36.0.19, 48.0.7, 49.0.4 or 50.x. Versions 37 to 42 need moving to a fixed line.
- Binaries and containers: search your SBOMs or scanner output for `wasmtime` and `cranelift-codegen`.
- Prioritize **aarch64** hosts (Graviton, Ampere, Apple Silicon build farms) and anything that compiles Wasm modules supplied by users or agents.
- Until you can upgrade, only accept Wasm from trusted sources, or precompile it on a patched build host.

Sources: [Wasmtime advisory GHSA-mghf-wjfp-p5xm](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm) · [Wasmtime advisory GHSA-897f-g5gm-fmxm](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm)