Summary
ZeroClaw builds using the plugins-wasm feature contain a path traversal flaw in plugin installation because the wasm_path manifest field is not adequately validated. An attacker who convinces a user to install a crafted plugin may write files outside the intended plugins directory, potentially modifying shell startup files and enabling code execution.
Affected context
The vulnerability occurs in ZeroClaw installations that support WebAssembly plugin installation and process plugin manifests containing a wasm_path field. Risk is present when crafted plugin content can influence the destination path and the installation process has write access beyond the designated plugins directory.
Exploit preconditions
- Attack surface: ZeroClaw's WASM plugin installation workflow
- Required access: The ability to persuade a user or operator to install a crafted plugin
- Trigger point: Processing the
wasm_pathvalue during plugin installation - Why exploitation is possible: Insufficient path validation may allow a manifest-controlled path to resolve outside the intended plugins directory
- Environmental dependency: The installer must have permission to write to the targeted filesystem location
Why this happens
The underlying bug is improper neutralization of path elements supplied through a plugin manifest. When the wasm_path value is trusted without canonicalization and containment checks, traversal sequences or equivalent path manipulation can redirect file writes outside the approved installation directory. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- An attacker may overwrite arbitrary files accessible to the installer
- Shell startup files or other user-controlled execution paths could be modified
- The affected user account may execute attacker-controlled code
- Plugin integrity and local application data could be compromised
- A compromised account could enable further local or network-based attacks
General mitigation guidance
Mitigation generally focuses on enforcing a strict destination boundary for all plugin files and reducing trust in manifest-controlled paths.
Common defensive patterns include:
- Canonicalizing candidate paths before use and verifying they remain within the intended plugins directory
- Rejecting absolute paths, traversal components, symbolic-link escapes, and unexpected path formats
- Deriving output filenames from trusted application state rather than accepting arbitrary manifest destinations
- Applying strict manifest schemas and allowlists for supported plugin fields
- Installing plugins with least-privilege filesystem permissions and isolated service accounts
- Treating third-party plugins as untrusted and requiring review or provenance checks before installation
- Using controlled, non-writable locations for shell configuration and other sensitive startup files
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis rules for path joins that use manifest or archive values without canonical containment checks
- Code review searches for absolute paths, parent-directory components, and unchecked filesystem writes
- Tests covering traversal, symlink, canonicalization, and platform-specific path edge cases
- Runtime monitoring for plugin installers writing outside approved directories
- File integrity policies covering shell startup files and other sensitive user configuration
- CI enforcement requiring path-boundary tests and security review for plugin installation changes
