CVE-2026-101885 in ZeroClaw
Summary
by MITRE • 09/30/2026
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The security flaw identified in ZeroClaw versions prior to 0.8.5 represents a critical path traversal vulnerability rooted in insufficient input validation during the plugin installation process. This specific weakness is triggered when the application is compiled with the plugins-wasm feature enabled, which allows for WebAssembly-based extensions. The core technical failure lies in the handling of the wasm_path manifest field within the plugin package metadata. When a user initiates an install command, the software parses this path string without adequately sanitizing or validating it against directory traversal sequences such as dot-dot-slash patterns. Consequently, instead of restricting file writes to the designated plugins directory structure, the application resolves the provided path relative to the root filesystem or current working environment, allowing for arbitrary file system access beyond the intended sandbox boundaries.
From an operational perspective, this vulnerability enables a remote code execution scenario through social engineering tactics rather than direct network exploitation. An attacker does not need to exploit a service running on a server but instead targets end-users by distributing maliciously crafted plugin packages disguised as legitimate extensions. When a victim installs such a package, the path traversal flaw allows the installer to overwrite critical system files located outside the application's scope. Common targets for this type of attack include shell startup scripts like .bashrc or .zshrc on Unix-like systems, which are executed every time a new terminal session is opened. By injecting malicious commands into these configuration files, an attacker can achieve persistent code execution with the privileges of the user account running ZeroClaw, effectively compromising the integrity and confidentiality of the local environment.
This vulnerability aligns closely with Common Weakness Enumeration category CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The failure to canonicalize or restrict file paths during installation is a classic example of this weakness. Furthermore, in the context of the MITRE ATT&CK framework, this attack vector maps to T1059 Command and Scripting Interpreter, specifically through the abuse of shell startup files for persistence and execution. It also relates to T1204 User Execution, as it requires a user action to install the malicious plugin package. The severity is heightened by the fact that WebAssembly plugins often operate with significant system access if not properly sandboxed, making the bypass of directory restrictions particularly dangerous.
Mitigation strategies for this vulnerability focus primarily on immediate software updates and defensive configuration practices. Users must upgrade ZeroClaw to version 0.8.5 or later, where the developers have implemented strict validation logic that sanitizes the wasm_path field before processing it. This typically involves canonicalizing paths and ensuring they remain within a predefined whitelist of allowed directories. For organizations deploying this software at scale, automated vulnerability scanning tools should be configured to detect versions prior to 0.8.5 with the plugins-wasm feature enabled. Additionally, security awareness training is recommended to educate users about verifying the source and integrity of plugin packages before installation, as no amount of technical control can fully prevent a user from willingly installing malicious content if social engineering succeeds. Implementing file integrity monitoring on critical shell configuration files can also provide early detection indicators for such exploitation attempts.