I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host.
https://ift.tt/UChpW3K
Submitted 2026-08-19T15:54:04Z by trustsigRobert
via reddit https://ift.tt/v7xb8Eh
trustsig.eu
Table flip: a wasm2c guest runs a shell command on the host, through one unchecked calloc
wasm2c sets a table's size from the element count the guest declared, then ignores whether the allocation succeeded. Make it fail and every table index becomes an absolute address on the host.
August 19, 2026 423 3
