EUVD-2026-63991
GHSA-gwmj-hf32-5v8v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure developer to malicious webpage
-
DeliveryRebind DNS to 127.0.0.1
-
ExploitSend authenticated request to local API
-
ExecutionInvoke process adapter
-
ImpactExecute arbitrary commands on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim is actively running a vulnerable Paperclip instance (before 0.3.1) locally in its default local_trusted mode, and that the developer visits an attacker-controlled webpage (UI:P - passive interaction). The attacker must operate a domain whose DNS they can rebind from a public IP to 127.0.0.1 to reach the local API, and the vulnerable process adapter endpoint must be reachable. Limiting factors: the target host must have Paperclip running at the time of the visit, the tool must be in the trusting default mode, and the browser must follow the rebinding - no server-side network exposure or attacker authentication is needed since the Host header is unvalidated. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H) drives the 9.4 score and reflects full compromise of the developer host with only passive user interaction - visiting a webpage. The realistic risk is tempered by the exploitation model: the victim must be actively running Paperclip locally in the vulnerable default mode and must visit an attacker-controlled page, so this is opportunistic or targeted against developers rather than mass-exploitable server-side. No EPSS score, KEV entry, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. DNS rebinding is a well-understood, reliable technique, so the AC:L and high technical-impact rating is credible; treat this as a genuine high priority for anyone running the affected tool, while noting the deployment footprint is narrow. |
| Exploit ScenarioDerived | A developer running Paperclip locally in default mode visits an attacker's webpage, which serves JavaScript that rebinds its domain to 127.0.0.1. The script then sends same-origin requests to Paperclip's local API, invokes the process adapter, and executes attacker-chosen commands on the developer's machine. No public POC is identified in the provided data, but the DNS rebinding technique is standard and reliable (AV:N/AC:L with only passive user interaction). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade to Paperclip 0.3.1 or later, the fixed release referenced in the vendor advisory GHSA-x8hx-rhr2-9rf7 (https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7); this is the primary and recommended fix. If immediate upgrade is not possible, reduce exposure by not leaving Paperclip's local server running while browsing untrusted sites, and where the option exists move off the default local_trusted mode so the API requires explicit authentication rather than trusting loopback callers. As a network-layer compensating control, use host-based firewall or browser controls to block cross-origin access to the local port; the trade-off is that these are partial mitigations against DNS rebinding and do not fully substitute for the Host-header validation delivered in 0.3.1. See also the VulnCheck advisory at https://www.vulncheck.com/advisories/paperclip-before-remote-code-execution-via-dns-rebinding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Paperclip runs a local API server that, in its default local_trusted mode, trusts requests reaching the loopback interface without authenticating the browser origin. The flaw is a classic DNS rebinding exposure: the server fails to verify the Host header, so a browser that first resolves an attacker domain to a public IP and then re-resolves it to 127.0.0.1 can send same-origin requests to the local service. This maps to CWE-862 (Missing Authorization) - the API grants privileged actions without confirming the caller is authorized. The exposed process adapter, intended for local command execution, becomes the sink that turns a cross-origin browser request into arbitrary OS command execution. The only affected CPE is cpe:2.3:a:paperclipai:paperclip.
Know when Paperclip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Browser-delivered DNS rebinding gives network reach with only a victim page visit (UI:R) against an unauthenticated local API (PR:N); command execution on the host beyond the vulnerable service justifies S:C with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.
Executive ViewAI
Paperclip before v0.3.1 contains a critical remote code execution vulnerability through DNS rebinding attacks targeting developer machines running the default local_trusted mode. An attacker-controlled website can rebind DNS to access the local API and execute arbitrary commands on a developer's machine, creating significant supply chain risk if development environments are compromised. No public exploit identified at time of analysis, but the CRITICAL severity requires prompt remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local API access to localhost only via firewall configuration, implement Host header validation at the network layer, disable or restrict local_trusted mode where operationally feasible, enforce network segmentation for development workstations, and conduct security training on DNS rebinding attack techniques.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 20
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperc
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation
Exploit-DB