CVE-2026-101885 is a path traversal vulnerability in zeroclaw-labs ZeroClaw versions prior to 0.8.5 when built with the plugins-wasm feature. The issue is due to improper validation of the wasm_path field in plugin manifests during installation. Exploiting this vulnerability, an attacker can craft malicious plugins that write arbitrary files outside the plugins directory, such as shell startup files, which can lead to code execution under the context of the user installing the plugin.

Successful exploitation allows an attacker to write arbitrary files outside the intended plugin directory, including sensitive locations like shell startup files. This can result in arbitrary code execution when the user starts their shell environment, compromising the user's system integrity and security.

Users should upgrade to ZeroClaw version 0.8.5 or later where this vulnerability is fixed. Since the vulnerability affects versions before 0.8.5, applying the official update is the recommended remediation. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.