Wasmer filesystem sandbox not enforced
SummaryAs of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox.Detailshttps://github.com/wasmerio/wasmer/issues/4267PoCA minimal Rust program:This should be compiled with `cargo build --target wasm32-wasi`. The compiled program, when run with wasmer WITHOUT `--dir`, can still create a file in the working directory.ImpactService providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem.