CVE-2026-119713
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.
Risk Assessment
An authenticated agent API key holder can execute arbitrary OS commands on the server host, leading to full compromise. However, a valid API key is required.
Recommendation
Update Paperclip to version 2026.416.0 or later. Restrict agent API key permissions and monitor for unusual commands.
Other vulnerabilities in Paperclip
See all- CVE-2026-77087Critical
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.
- CVE-2026-41208High
Paperclip (@paperclipai/server) versions prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. Agents can update their own adapterConfig via the /agents/:id endpoint, and the adapterConfig.workspaceStrategy.provisionCommand field is later executed by the server during workspace provisioning.
Original NVD description (English source)
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS