ZeroClaw: Path traversal in plugin installation via wasm_path manifest field
Summary
ZeroClaw versions before 0.8.5 built with the plugins-wasm feature do not validate the wasm_path field in plugin manifests during installation. An attacker who convinces a user to install a crafted plugin can write arbitrary files outside the plugins directory, such as shell startup files, which can lead to code execution in the context of the installing user. Exploitation requires that a user installs the malicious plugin; a proof of concept exists, but no active exploitation is known.
Affected
- ZeroClaw versions before 0.8.5 built with the plugins-wasm feature
- Builds without the plugins-wasm feature are not described as affected
Fixed in
- Upgrade to ZeroClaw 0.8.5 or newer. No backported fixes for older release lines are known.
Workaround
- No official workaround known. Only install plugins from trusted sources until the upgrade is complete.
- Disable WASM plugin support if it is not needed (secondary source).
Exploitation
- Proof of concept available (CISA SSVC: exploitation poc, automatable: no).
- No confirmed active exploitation known; not listed in CISA KEV.
- EPSS below 1%.
- Attack vector is local; user interaction required, no privileges needed.
Our recommendation
- Identify ZeroClaw installations and check whether they are built with the plugins-wasm feature.
- Upgrade affected installations to 0.8.5 or newer.
- Until upgraded, restrict plugin installation to vetted sources.
- Check affected hosts, especially developer workstations, for unexpected changes to shell startup files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-93f6-34w8-5g98 github.com
- VulnCheck advisory: ZeroClaw path traversal via plugin manifest wasm_path www.vulncheck.com
- ZeroClaw release v0.8.5 github.com
- Fix commit 432e034 github.com
- Vulnerable code: host.rs at v0.8.4 github.com
- OSV: CVE-2026-101885 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:41.
Original description (NVD)
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
NVD references (6)
- https://github.com/zeroclaw-labs/zeroclaw/blob/v0.8.4/crates/zeroclaw-plugins/src/host.rs#L238-L273
- https://github.com/zeroclaw-labs/zeroclaw/commit/432e034d3cb024610d5916a2f328678d151c1dd5
- https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.8.5
- https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98
- https://www.vulncheck.com/advisories/zeroclaw-before-0.8.5-path-traversal-via-plugin-manifest-wasm-path
- https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.