Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck
CVE-2026-101885ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
High 7.8
In plain English
A high-severity path traversal in ZeroClaw from zeroclaw-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zeroclaw-labs | ZeroClaw | 0 – before 0.8.5 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-93f6-34w8-5g98) vendor-advisory
- https://github.com/zeroclaw-labs/zeroclaw/commit/432e034d3cb024610d5916a2f328678d151c1dd5 patch
- ZeroClaw v0.8.5 Release Notes release-notes
- https://github.com/zeroclaw-labs/zeroclaw/blob/v0.8.4/crates/zeroclaw-plugins/src/host.rs#L238-L273 technical-description
- VulnCheck Advisory: ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path third-party-advisory