CVE-2026-101885 — ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field.…
Published: 2026-09-30 · CVSS: 8.5 · CVSS 4.0
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7