Paperclipai
Monthly
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 2026.416.0) via authentication bypass through a six-step API call chain. The attack requires no credentials, no user interaction, and succeeds against default 'authenticated' mode deployments exposed to network access. CVSS 10.0 with scope change indicates container/host escape potential. No active exploitation confirmed in CISA KEV at time of analysis, though the vendor advisory (GitHub Security Advisory GHSA-68qg-g8mg-6pr7) confirms the critical authentication bypass mechanism in both @paperclipai/server and paperclip npm packages.
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 2026.416.0) via authentication bypass through a six-step API call chain. The attack requires no credentials, no user interaction, and succeeds against default 'authenticated' mode deployments exposed to network access. CVSS 10.0 with scope change indicates container/host escape potential. No active exploitation confirmed in CISA KEV at time of analysis, though the vendor advisory (GitHub Security Advisory GHSA-68qg-g8mg-6pr7) confirms the critical authentication bypass mechanism in both @paperclipai/server and paperclip npm packages.
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.