paperclip vulnerabilities

2 known vulnerabilities in paperclip from Paperclipai. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  paperclip: Missing Authorization

  CVE-2026-77087Aug 21, 2026Paperclipai

  Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses

• 10.0 Critical severity

  paperclip: Improper Authentication

  CVE-2026-41679Apr 23, 2026PaperclipaiEPSS 31.7%

  Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authent