●PocketClawAI security alerts
Sign in
highCVSS 7.8NVD status: Deferred

CVE-2026-101885

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field.

ComponentZeroClaw
Severityhigh (CVSS 7.8)
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published (NVD)2026-09-30
Last modified2026-10-01
Affected versions
< 0.8.5
read from the advisory text: NVD has not published CPE data yet
Fixed in0.8.5
WeaknessCWE-22
CISA KEVnot listed

NVD description

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.

Does CVE-2026-101885 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for ZeroClaw.
Check my stack

What to do

  • Upgrade ZeroClaw to 0.8.5 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources