High severity · published Sep 30, 2026
CVE-2026-101885
ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
ZeroClaw · zeroclaw-labs
before 0.8.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101885
vendor-advisory
https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98
patch
https://github.com/zeroclaw-labs/zeroclaw/commit/432e034d3cb024610d5916a2f328678d151c1dd5
release-notes
https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.8.5
technical-description
https://github.com/zeroclaw-labs/zeroclaw/blob/v0.8.4/crates/zeroclaw-plugins/src/host.rs#L238-L273
third-party-advisory
https://www.vulncheck.com/advisories/zeroclaw-before-0.8.5-path-traversal-via-plugin-manifest-wasm-path