CVE-2026-101885High· 7.8▾ MidnightPoC available

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 30, 2026

Updated

Sep 30, 2026

CVSS

7.8

Vendor

zeroclaw-labs

Product

ZeroClaw

CWE

CWE-22

Depth score

55 · Moderate

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-30

Exploitation: poc
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

zeroclaw-labs CWE-22 #nvd #cve.org #exploit-available

Affected

ZeroClaw < 0.8.5

Full technical detail▾

Overview

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available