Skip to content
OpenAdvisories

Package · npm

@paperclipai/server

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    GHSA-p7mm-r948-4q3q

    Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

    ## Summary The approval-resolution endpoints (`POST /approvals/:id/approve`, `/reject`, `/request-revision`) accept a client-supplied `decidedByUserId` field in the request body and write it verbatim into the authoritative `approvals.decidedByUserId` column —…

    @paperclipai/server npm