ZeroClaw EUVD-2026-90258

Exploitation requires: (1) a ZeroClaw build compiled with the plugins-wasm feature; (2) a version before 0.8.5; (3) plugin signature verification in its default Disabled mode (the patch tests note the path guard is the only gate in that mode); and (4) a victim being persuaded to install an attacker-supplied plugin whose manifest.toml contains a wasm_path with '..' or absolute/root/drive-prefix components. The decisive limiting factor is the required user action (UI:P) - the victim must actively install the malicious package - and the local attack vector (AV:L); there is no remote or unauthenticated path to the sink. Impact is realized only when the overwritten file (e.g., a shell startup script) is subsequently executed.

This is a genuine but conditional local vulnerability, not a mass-exploitable network flaw. The vendor CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 largely because it credits full high confidentiality/integrity/availability impact from the resulting code execution, but the AV:L and UI:P (passive user interaction) metrics correctly capture that an attacker cannot reach the sink remotely - a user must be socially engineered into installing a malicious plugin. No EPSS score was provided, the CVE is not in CISA KEV, and no standalone public exploit was identified; however, the patch commit ships a working regression test (install_rejects_wasm_path_traversal) that concretely demonstrates the '../../pwned.wasm' traversal write, so a reliable reproducer effectively exists in the open. Signal alignment is consistent: this reads as a real but lower-urgency issue whose practical risk hinges on social-engineering the victim, not on raw score. The main caveat is prevalence - ZeroClaw appears to be a small/niche Rust project, so real-world exposure is limited even though the technical impact (code execution via poisoned shell startup files) is severe.

An attacker publishes a crafted ZeroClaw plugin package whose manifest.toml sets wasm_path to a traversal path like '../../.bashrc' or another shell startup file. When a victim running a vulnerable ZeroClaw build (with the plugins-wasm feature, before 0.8.5) is convinced to install it, the installer writes the attacker-controlled file outside the plugins directory, planting code that executes the next time the user opens a shell. A functional reproducer is embedded in the fix's regression tests, so the technique is publicly demonstrable even though no packaged exploit is catalogued.