Zeroclaw Before 0.8.5 Path Traversal Via Plugin Manifest Wasm Path

Back www.vulncheck.com

Zeroclaw Before 0.8.5 Path Traversal Via Plugin Manifest Wasm Path

www.vulncheck.com • October 1, 2026

Share: View original

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

GitHub Security Advisory (GHSA-93f6-34w8-5g98)

ZeroClaw v0.8.5 Release Notes

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Path Traversal Vulnerability in ZeroClaw Plugins A path traversal vulnerability identified as CVE-2026-101885 affects ZeroClaw versions prior to 0.8.5 built with the plugins-wasm feature. This flaw allows attackers to craft malicious plugins that can write arbitrary files outside the designated plugins directory, potentially enabling code execution. The vulnerability arises from the failure to validate the wasm_path manifest field during plugin installation. Users installing untrusted plugins are at high risk, especially on developer workstations and self-hosted environments. A proof-of-concept exists, but there are no confirmed reports of active exploitation. Users are advised to upgrade to version 0.8.5 or disable WASM plugin support if not needed. The CVSS score for this vulnerability is 8.5, categorized as high concern. Mitigation strategies include reviewing plugin manifests and monitoring for unauthorized file changes. 1 sources 65

Extracted Entities

CWE Weaknesses (1)

CWE-22 - Path Traversal

Vulnerabilities (1)