Skip to content
OpenAdvisories

Package · npm

@paperclipai/server

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-119713

    Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

    Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspac…

    paperclipai @paperclipai/server @paperclipai/server npm
  • High 8.8
    CVE-2026-41208

    Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

    Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbit…

    paperclipai @paperclipai/server @paperclipai/server npm
  • High 8.3
    GHSA-xfqj-r5qw-8g4j

    Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

    ## Summary Several API endpoints in `authenticated` mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed. Verified against the…

    @paperclipai/server npm
  • High 7.3
    GHSA-w8hx-hqjv-vjcq

    Paperclip: Malicious skills able to exfiltrate and destroy all user data

    ### Summary An arbitrary code execution vulnerability in the workspace runtime service allows any agent to execute shell commands on the server, exposing all environment variables including API keys, JWT secrets, and database credentials. ### Details A malici…

    @paperclipai/server npm