CVE-2026-101885: ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZeroClawto a version that resolves this vulnerability.Fixed in 0.8.5
Event History
Frequently Asked Questions
Which installations are affected?
ZeroClaw versions before 0.8.5 are affected only when built with the plugins-wasm feature. Installations without that feature are not identified as affected by the provided data.
What does an attacker need to exploit this issue?
An attacker must convince a user to install a crafted plugin. The malicious plugin uses the wasm_path manifest field to write files outside the intended plugins directory.
What is the likely impact of a successful exploit?
A crafted plugin can write arbitrary files to locations outside the plugins directory, including shell startup files. This can enable code execution with the privileges of the affected user.
What should be prioritized for remediation?
Update affected ZeroClaw installations to version 0.8.5 or later. Until updating is possible, avoid installing untrusted plugins, since exploitation requires user installation of a crafted plugin.