EUVD-2026-25162
GHSA-265w-rf2w-cjh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on @paperclipai/server (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.416.0.
DescriptionGitHub Advisory
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.
AnalysisAI
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Technical ContextAI
This vulnerability affects Paperclip, a Node.js-based AI agent orchestration platform with React UI. The root cause is CWE-78 (OS Command Injection) stemming from insufficient input validation in the agent configuration update mechanism. The server exposes a REST API endpoint (/agents/:id) that permits agents to modify their own adapterConfig settings, including the adapterConfig.workspaceStrategy.provisionCommand field. This configuration value is later passed to a shell execution context during workspace provisioning without proper sanitization or validation. The vulnerability exploits the architectural design where agent runtime configurations are stored and later executed by the privileged server process, creating an unsafe deserialization/execution pattern. The trust boundary violation occurs because agents-which should operate in restricted runtime contexts-gain the ability to influence server-side command execution through configuration manipulation. This represents a classic privilege escalation from a lower-privileged agent context to the server host execution context.
RemediationAI
Upgrade @paperclipai/server to version 2026.416.0 or later immediately using npm (npm install @paperclipai/server@2026.416.0) or yarn (yarn upgrade @paperclipai/server@2026.416.0). Verify the installation by checking package.json shows "@paperclipai/server": "2026.416.0" or higher. After upgrading, rotate all Agent API keys as a precautionary measure to invalidate potentially compromised credentials. If immediate patching is not feasible, implement network segmentation to restrict which systems can reach the /agents/:id endpoint, enforce strict firewall rules limiting access to trusted IP ranges only, and audit all agent configurations for suspicious provisionCommand values (look for shell metacharacters, curl/wget commands, or unexpected system utilities). Monitor server process execution logs for unexpected child processes spawned during workspace provisioning. Note that restricting API access reduces functionality for legitimate remote agents and should be considered a temporary control only. Detailed remediation guidance is available in the GitHub Security Advisory at https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today