Paperclip Server CVE-2026-119713

The attacker must be able to call PATCH /api/execution-workspaces/:id and store a cleanupCommand (or teardownCommand) value, then cause the target workspace to be archived so cleanupExecutionWorkspaceArtifacts executes it via child_process.spawn(shell,['-c',command]) with no validation, allowlisting, or escaping. In the default desktop 'local_trusted' mode this needs NO authentication - any local process or malicious web page hitting 127.0.0.1:3100 is auto-granted instance-admin and the boardMutationGuard is bypassed; in 'authenticated' mode any user with company access can do it because the company-access check runs after the DB query (BOLA/IDOR). Limiting factors: the attacker must reach the API endpoint and trigger an archive, and a shell must be present - native on Linux/macOS (/bin/sh), and on Windows via sh.exe from Git for Windows, which Paperclip requires and is therefore present on most installs.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The signals are largely consistent: CVSS 4.0 base 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N, full VC/VI/VA:H) describes a low-complexity, network-reachable command-injection RCE, and that mechanism is corroborated by the GHSA advisory, the VulnCheck advisory, the vulnerable source file, and a published PoC script that demonstrated three independent RCE proofs on Windows 11 (file write, systeminfo exfiltration, calc.exe launch). The vuln.today Decision label is 'this_week', which supports prompt but not emergency remediation. Two caveats must be stated explicitly: (1) EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here; (2) the CVSS PR:L assumes an authenticated/key-holding actor, but the advisory documents that in the default desktop 'local_trusted' mode every request is auto-granted instance-admin with ZERO authentication - meaning real-world privilege requirements are effectively PR:N for default desktop installs and PR:L (any company user, via a BOLA/IDOR-style post-query access check) for authenticated team deployments. This is not in CISA KEV, so there is no confirmed active exploitation; the elevated risk comes from working public exploit code plus trivial exploitability, not observed in-the-wild use.

A low-complexity actor reaches the Paperclip workspace API (for a default desktop install, any local process or a malicious web page making requests to 127.0.0.1:3100 with no authentication; for a team deployment, any user with company access) and issues PATCH /api/execution-workspaces/:id to store an attacker-chosen cleanupCommand, then archives the workspace so cleanupExecutionWorkspaceArtifacts runs it through a shell as the server process. A published, automated PoC exploit script (poc_paperclip_rce.py) exists and demonstrated three independent RCE proofs on Windows 11, so weaponization requires no novel research. Because the command runs with the server process's privileges, the attacker can exfiltrate system data, pivot, or backdoor the source repositories the server manages.