Home / Docs

Security Audit Report

Date: 2026-04-24 Auditor: Automated (cargo-audit + manual review) Scope: Suture VCS workspace (629 crate dependencies)

Dependency Vulnerability Summary

Critical (2)

IDCrateVersionTitle RUSTSEC-2026-0095wasmtime22.0.1Winch compiler sandbox-escaping memory access RUSTSEC-2026-0096wasmtime22.0.1Miscompiled guest heap access enables sandbox escape (aarch64 Cranelift)

Recommendation: Upgrade wasmtime to >=36.0.7, <37.0.0 OR >=42.0.2, <43.0.0 OR >=43.0.1. These are sandbox-escape vulnerabilities in the Wasmtime WASM runtime used by suture-driver for plugin execution. Impact depends on whether untrusted WASM plugins are loaded.

Medium (8)

IDCrateSeverityTitle RUSTSEC-2026-0020wasmtime6.9Guest-controlled resource exhaustion in WASI RUSTSEC-2026-0021wasmtime6.9Panic adding excessive fields to wasi:http/types.fields RUSTSEC-2026-0091wasmtime6.1OOB write when transcoding component model strings RUSTSEC-2026-0094wasmtime6.1Improperly masked return value from table.grow RUSTSEC-2026-0085wasmtime5.6Panic when lifting flags component value RUSTSEC-2026-0089wasmtime5.9Host panic when Winch executes table.fill RUSTSEC-2026-0092wasmtime5.9Panic when transcoding misaligned UTF-16 strings RUSTSEC-2026-0093wasmtime6.9Heap OOB read in UTF-16 to latin1+utf16 transcoding RUSTSEC-2026-0087wasmtime4.1Segfault with f64x2.splat on Cranelift x86-64

All medium-severity findings are in wasmtime 22.0.1. Upgrading to >=24.0.7 resolves most.

Low (4)

IDCrateSeverityTitle RUSTSEC-2024-0438wasmtime-Windows device filename sandboxing RUSTSEC-2025-0046wasmtime3.3Host panic with fd_renumber WASIp1 RUSTSEC-2025-0118wasmtime1.8Unsound API access to shared linear memory RUSTSEC-2026-0086wasmtime2.3Host data leakage with 64-bit tables RUSTSEC-2026-0088wasmtime2.3Data leakage between pooling allocator instances

Warnings (5)

IDCrateCategoryTitle RUSTSEC-2025-0057fxhash 0.2.1unmaintainedNo longer maintained RUSTSEC-2024-0384instant 0.1.13unmaintainedUnmaintained (via notify) RUSTSEC-2024-0436paste 1.0.15unmaintainedNo longer maintained RUSTSEC-2026-0002lru 0.12.5unsoundIterMut violates Stacked Borrows RUSTSEC-2024-0442wasmtime-jit-debug 22.0.1unsoundDump Undefined Memory

Fuzz Targets Created

7 libfuzzer-sys harness files in crates/suture-fuzz/fuzz_targets/:

TargetDescriptionNotes fuzz_patch_deserialize.rsPatch JSON deserializationTests suture_core::patch::types::Patch fuzz_hash_parse.rsHash hex parsingTests suture_common::Hash::from_hex fuzz_json_merge.rsJSON semantic 3-way mergeUses suture_driver_json::JsonDriver fuzz_yaml_merge.rsYAML semantic 3-way mergeUses suture_driver_yaml::YamlDriver fuzz_toml_merge.rsTOML semantic 3-way mergeUses suture_driver_toml::TomlDriver fuzz_classification.rsClassification pattern regexTests 13 regex patterns from classification detection fuzz_diff_input.rsUnified diff parserInline re-implementation (suture-cli is binary-only)

Existing proptest-based smoke tests remain in crates/suture-fuzz/src/lib.rs.

Recommendations

  1. [Critical] Upgrade wasmtime from 22.0.1 to >=24.0.7 (or latest stable). This resolves 14 of 16 vulnerabilities.
  2. [Medium] Evaluate whether untrusted WASM plugins can be loaded. If so, the wasmtime sandbox escapes are exploitable.
  3. [Low] Upgrade lru to fix Stacked Borrows unsoundness (via ratatui -> suture-tui).
  4. [Housekeeping] Replace fxhash and instant with maintained alternatives when upstream deps update.
  5. [Fuzzing] Run the new fuzz targets with cargo-fuzz in CI for continuous coverage.
  6. [Supply chain] Pin dependency versions in Cargo.lock and review changes in PRs.
GitHub · AGPL-3.0