Paperclipai vulnerabilities
We track 4 vulnerabilities in Paperclipai products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Paperclipai vulnerabilities
- 8.8 High severity
@paperclipai/server: Improper Neutralization of Special Elements used in an OS Command
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspace
- 9.6 Critical severity
paperclip: Missing Authorization
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses
- 10.0 Critical severity
paperclip: Improper Authentication
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authent
- 8.8 High severity
@paperclipai/server: Improper Neutralization of Special Elements used in an OS Command
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitr