Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Paperclip Paperclipai
Products
Paperclipai/server Paperclipai\/server Paperclipai/server
CVE-2026-41679

Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

CVSS 3.1 · 10 Critical EPSS 31.7% KEV · Not listed
Vendors
Paperclip
Products
Paperclipai Paperclipai/server Paperclipai\/server