Threats affecting pkg:github/ZeroClaw

ZeroClaw versions before 0.8.5 built with the plugins-wasm feature have a path traversal vulnerability in the plugin installation process. This flaw allows attackers to craft plugins that write files outside the intended plugins directory by exploiting improper validation of the wasm_path manifest field. Such unauthorized file writes can include shell startup files, potentially enabling code execution when the user runs their shell.