EUVD-2026-25162
GHSA-265w-rf2w-cjh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on @paperclipai/server (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.416.0.
DescriptionGitHub Advisory
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.
AnalysisAI
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Technical ContextAI
This vulnerability affects Paperclip, a Node.js-based AI agent orchestration platform with React UI. The root cause is CWE-78 (OS Command Injection) stemming from insufficient input validation in the agent configuration update mechanism. The server exposes a REST API endpoint (/agents/:id) that permits agents to modify their own adapterConfig settings, including the adapterConfig.workspaceStrategy.provisionCommand field. This configuration value is later passed to a shell execution context during workspace provisioning without proper sanitization or validation. The vulnerability exploits the architectural design where agent runtime configurations are stored and later executed by the privileged server process, creating an unsafe deserialization/execution pattern. The trust boundary violation occurs because agents-which should operate in restricted runtime contexts-gain the ability to influence server-side command execution through configuration manipulation. This represents a classic privilege escalation from a lower-privileged agent context to the server host execution context.
RemediationAI
Upgrade @paperclipai/server to version 2026.416.0 or later immediately using npm (npm install @paperclipai/server@2026.416.0) or yarn (yarn upgrade @paperclipai/server@2026.416.0). Verify the installation by checking package.json shows "@paperclipai/server": "2026.416.0" or higher. After upgrading, rotate all Agent API keys as a precautionary measure to invalidate potentially compromised credentials. If immediate patching is not feasible, implement network segmentation to restrict which systems can reach the /agents/:id endpoint, enforce strict firewall rules limiting access to trusted IP ranges only, and audit all agent configurations for suspicious provisionCommand values (look for shell metacharacters, curl/wget commands, or unexpected system utilities). Monitor server process execution logs for unexpected child processes spawned during workspace provisioning. Note that restricting API access reduces functionality for legitimate remote agents and should be considered a temporary control only. Detailed remediation guidance is available in the GitHub Security Advisory at https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today