Paperclipai
Monthly
Remote code execution in Paperclip AI server versions 2026.403.0 through 2026.416.0: an attacker who can call PATCH /api/execution-workspaces/:id can store an arbitrary cleanupCommand (or teardownCommand), which the server later runs through a shell as the Paperclip process when the workspace is archived. The CVSS 4.0 vector rates it 8.7 with PR:L, but the practical bar is far lower on default desktop installs - in local_trusted mode every request to 127.0.0.1:3100 is auto-granted instance-admin with no authentication and the board-mutation guard is bypassed, while in authenticated mode any user with company access qualifies because the company-access check runs after the database query. This is a genuine high-priority issue rather than an inflated-CVSS artifact; the vendor advisory ships a public proof-of-concept script (file write, systeminfo exfiltration, calc.exe launch on Windows 11), though this analysis has not independently verified that script as working exploit code, and there is no CISA KEV entry indicating confirmed active exploitation.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 2026.416.0) via authentication bypass through a six-step API call chain. The attack requires no credentials, no user interaction, and succeeds against default 'authenticated' mode deployments exposed to network access. CVSS 10.0 with scope change indicates container/host escape potential. No active exploitation confirmed in CISA KEV at time of analysis, though the vendor advisory (GitHub Security Advisory GHSA-68qg-g8mg-6pr7) confirms the critical authentication bypass mechanism in both @paperclipai/server and paperclip npm packages.
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Remote code execution in Paperclip AI server versions 2026.403.0 through 2026.416.0: an attacker who can call PATCH /api/execution-workspaces/:id can store an arbitrary cleanupCommand (or teardownCommand), which the server later runs through a shell as the Paperclip process when the workspace is archived. The CVSS 4.0 vector rates it 8.7 with PR:L, but the practical bar is far lower on default desktop installs - in local_trusted mode every request to 127.0.0.1:3100 is auto-granted instance-admin with no authentication and the board-mutation guard is bypassed, while in authenticated mode any user with company access qualifies because the company-access check runs after the database query. This is a genuine high-priority issue rather than an inflated-CVSS artifact; the vendor advisory ships a public proof-of-concept script (file write, systeminfo exfiltration, calc.exe launch on Windows 11), though this analysis has not independently verified that script as working exploit code, and there is no CISA KEV entry indicating confirmed active exploitation.
Remote code execution in paperclipai's Paperclip before 0.3.1 lets a malicious website hijack a developer's locally running instance through DNS rebinding. Because the default local_trusted mode never validates incoming Host headers, an attacker-controlled webpage can rebind DNS to the local API, issue authenticated requests, and drive the process adapter to run arbitrary commands on the developer's machine. Reported by VulnCheck with a CVSS 4.0 base score of 9.4; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers achieve full code execution on Paperclip AI orchestration servers (versions prior to 2026.416.0) via authentication bypass through a six-step API call chain. The attack requires no credentials, no user interaction, and succeeds against default 'authenticated' mode deployments exposed to network access. CVSS 10.0 with scope change indicates container/host escape potential. No active exploitation confirmed in CISA KEV at time of analysis, though the vendor advisory (GitHub Security Advisory GHSA-68qg-g8mg-6pr7) confirms the critical authentication bypass mechanism in both @paperclipai/server and paperclip npm packages.
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.