CVE-2026-101885

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101885
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101885.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101885
Aliases
  • GHSA-93f6-34w8-5g98
Published
2026-09-30T19:16:05Z
Modified
2026-10-02T03:47:10Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
Details

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101885.json"
}
References

Affected packages

Git / github.com/zeroclaw-labs/zeroclaw

Affected ranges

Type
GIT
Repo
https://github.com/zeroclaw-labs/zeroclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cb2b20a9fe59004b7ef03e123942d31f29236d15
Fixed
432e034d3cb024610d5916a2f328678d151c1dd5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.8.5"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.2
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.7-beta.2
v0.1.7-beta.28
v0.1.7-beta.30
v0.1.9-beta.136
v0.1.9-beta.140
v0.1.9-beta.141
v0.1.9-beta.148
v0.1.9-beta.150
v0.1.9-beta.151
v0.1.9-beta.152
v0.1.9-beta.153
v0.1.9-beta.157
v0.1.9-beta.161
v0.1.9a
v0.2.0-beta.162
v0.2.0-beta.163
v0.2.0-beta.166
v0.2.0-beta.167
v0.2.0-beta.170
v0.2.0-beta.172
v0.2.1
v0.2.1-beta.178
v0.2.1-beta.179
v0.2.1-beta.180
v0.2.1-beta.183
v0.2.1-beta.186
v0.2.1-beta.187
v0.2.1-beta.188
v0.2.2-beta.190
v0.3.0
v0.3.0-beta.196
v0.3.0-beta.200
v0.3.0-beta.201
v0.3.1
v0.3.1-beta.205
v0.3.1-beta.210
v0.3.1-beta.211
v0.3.1-beta.212
v0.3.1-beta.213
v0.3.1-beta.214
v0.3.2
v0.3.2-beta.215
v0.3.2-beta.216
v0.3.3-beta.217
v0.3.3-beta.218
v0.3.4-beta.230
v0.3.4-beta.231
v0.3.4-beta.232
v0.4.0
v0.4.0-beta.257
v0.4.0-beta.258
v0.4.0-beta.259
v0.4.0-beta.260
v0.4.1-beta.266
v0.4.1-beta.267
v0.4.1-beta.269
v0.4.2-beta.281
v0.4.2-beta.300
v0.4.3
v0.4.3-beta.310
v0.4.3-beta.311
v0.4.3-beta.312
v0.4.3-beta.313
v0.4.3-beta.314
v0.4.3-beta.316
v0.4.3-beta.317
v0.4.3-beta.323
v0.5.0
v0.5.0-beta.340
v0.5.0-beta.341
v0.5.0-beta.344
v0.5.0-beta.345
v0.5.0-beta.346
v0.5.0-beta.347
v0.5.0-beta.349
v0.5.0-beta.351
v0.5.0-beta.357
v0.5.0-beta.360
v0.5.0-beta.364
v0.5.0-beta.365
v0.5.0-beta.368
v0.5.0-beta.369
v0.5.1
v0.5.1-beta.378
v0.5.1-beta.379
v0.5.1-beta.390
v0.5.1-beta.400
v0.5.1-beta.402
v0.5.1-beta.403
v0.5.1-beta.413
v0.5.1-beta.414
v0.5.1-beta.438
v0.5.2
v0.5.2-beta.441
v0.5.2-beta.442
v0.5.2-beta.448
v0.5.2-beta.457
v0.5.3
v0.5.3-beta.458
v0.5.4
v0.5.4-beta.471
v0.5.4-beta.487
v0.5.4-beta.490
v0.5.4-beta.491
v0.5.4-beta.504
v0.5.5
v0.5.5-beta.514
v0.5.5-beta.516
v0.5.5-beta.517
v0.5.5-beta.519
v0.5.5-beta.521
v0.5.5-beta.522
v0.5.6
v0.5.6-beta.523
v0.5.6-beta.524
v0.5.6-beta.526
v0.5.6-beta.536
v0.5.7
v0.5.7-beta.554
v0.5.7-beta.563
v0.5.8
v0.5.8-beta.564
v0.5.8-beta.577
v0.5.9
v0.5.9-beta.578
v0.5.9-beta.579
v0.6.0
v0.6.1
v0.6.1-beta.637
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0-beta.1047
v0.7.1-beta.1049
v0.7.3
v0.7.3-beta.1051
v0.7.4
v0.8.0
v0.8.0-beta-1
v0.8.0-beta-2
v0.8.1
v0.8.2
v0.8.3
v0.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101885.json"