EUVD-2026-25166
GHSA-68qg-g8mg-6pr7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
Articles & Coverage 1
AnalysisAI
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 2026.416.0) via authentication bypass through a six-step API call chain. The attack requires no credentials, no user interaction, and succeeds against default 'authenticated' mode deployments exposed to network access. CVSS 10.0 with scope change indicates container/host escape potential. No active exploitation confirmed in CISA KEV at time of analysis, though the vendor advisory (GitHub Security Advisory GHSA-68qg-g8mg-6pr7) confirms the critical authentication bypass mechanism in both @paperclipai/server and paperclip npm packages.
Technical ContextAI
Paperclip is a Node.js-based AI agent orchestration platform with a React frontend, designed to coordinate multiple AI agents for business automation workflows. The vulnerability stems from CWE-287 (Improper Authentication), indicating a flaw in the authentication mechanism when the server operates in 'authenticated' mode - ironically the configuration intended to provide security controls. The affected components are the @paperclipai/server npm package and the paperclip package, both distributed through the npm ecosystem. The CVSS scope change (S:C) suggests the vulnerability allows attackers to escape the immediate application context, potentially compromising the underlying Node.js runtime, container environment, or host system. The six-API-call chain indicates a multi-stage exploit leveraging sequential endpoints, likely bypassing authentication checks through parameter manipulation, session mishandling, or privilege escalation across API boundaries. The attack surface is any network-exposed Paperclip instance running default configurations, making internet-facing deployments particularly vulnerable.
RemediationAI
Immediately upgrade both @paperclipai/server and paperclip npm packages to version 2026.416.0 or later as confirmed by GitHub Security Advisory GHSA-68qg-g8mg-6pr7 (https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7). Use npm update or yarn upgrade commands and verify installed versions with npm list @paperclipai/server and npm list paperclip. For environments unable to immediately patch, implement network-layer access controls to restrict Paperclip instance exposure: deploy behind VPN with IP whitelisting for authorized users only, configure firewall rules to block public internet access to Paperclip ports, or use reverse proxy with additional authentication layer (note this is compensating control, not fix for the underlying authentication bypass). Remove Paperclip instances from DMZ or internet-facing networks until patched. Monitor access logs for unusual sequences of API calls or authentication anomalies as potential exploitation indicators. Side effects of network restrictions include breaking legitimate remote access workflows - document authorized IP ranges before implementing controls. Do not rely solely on changing default configurations or disabling 'authenticated' mode, as the vulnerability's scope suggests multiple attack vectors.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today