CVE-2026-101885

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

CVE-2026-101885

Versions of ZeroClaw before 0.8.5 built with the plugins-wasm feature are vulnerable to a path traversal vulnerability during plugin installation. The root cause is a failure to validate the wasm_path manifest field, which allows an attacker to trick a user into installing a crafted plugin. This ...

EUVD-2026-90258

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...