Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The GET, POST, and DELETE handlers under /agents/:id/keys in the Paperclip control-plane API only call assertBoard(req), which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membership is limited to Company A can therefore list, create, or revoke agent API keys for any agent in Company B by supplying the victim agent's UUID in the URL path. The POST handler returns the newly-minted token in cleartext, which authenticates subsequent requests as {type:"agent", companyId:<CompanyB}, giving the attacker full agent-level access inside the victim tenant — a complete cross-tenant compromise. Details The three vulnerable routes are defined in server/src/routes/agents.ts:2050-2087: assertBoard in server/src/routes/authz.ts:4-8 is intentionally narrow: It does not consult req.actor.companyIds or req.actor.isInstanceAdmin. Company-scoping is handled by a separate helper,…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The approval-resolution endpoints (POST /approvals/:id/approve, /reject, /request-revision) accept a client-supplied decidedByUserId field in the request body and write it verbatim into the authoritative approvals.decidedByUserId column — without cross-checking it against the authenticated actor. Any board user who can access an approval's company can record the decision as having been made by another user (e.g. the CEO), forging the governance audit trail. For hireagent approvals with a monthly budget, the same attacker-controlled string is also stamped onto the resulting budgetpolicies row as createdByUserId/updatedByUserId. Details Entry point — server/src/routes/approvals.ts:130: Authorization check — server/src/routes/authz.ts:4: assertBoard only checks that the caller is some board user; it never ties req.body.decidedByUserId to req.actor.userId. requireApprovalAccess/assertCompanyAccess only verify the attacker is allowed to touch the approval's company, which every…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
<img width="7007" height="950" alt="01-setup" src="https://github.com/user-attachments/assets/1596b8d1-8de5-4c21-b1d2-2db41b568d7e" / Isolated paperclip instance running in authenticated mode (default config) on a clean Docker image matching commit b649bd4 (2026.411.0-canary.8, post the 2026.410.0 patch). This advisory was verified on an unmodified build. Summary POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId (server/src/routes/agents.ts lines 2050-2087) only call assertBoard to authorize the caller. They never call assertCompanyAccess and never verify that the caller is a member of the company that owns the target agent. Any authenticated board user (including a freshly signed-up account with zero company memberships and no instanceadmin role) can mint a plaintext pcp agent API token for any agent in any company on the instance. The minted token is bound to the victim agent's companyId server-side, so every downstream assertCompanyAccess…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
| Field | Value | |-------|-------| | Affected Software | Paperclip AI v2026.403.0 | | Affected Component | Execution Workspace lifecycle (`workspace-runtime.ts`) | | Affected Endpoint | `PATCH /api/execution-workspaces/:id` | | Deployment Modes | All — `local_trusted` (zero auth), `authenticated` (any company user) | | Platforms | Linux, macOS, Windows (with Git installed) | | Date | 2026-04-13 | --- Executive Summary A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint. When the workspace is archived, the server executes this command verbatim via `child_process.spawn(shell, ["-c", cleanupCommand])` with no input validation or sanitization. In `local_trusted` mode (the default for desktop installations), this requires zero authentication. Three independent proofs of exploitation…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Several API endpoints in authenticated mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed. Verified against the latest version. Discord: sagi03581 Steps to Reproduce 1. Unauthenticated issue data access GET /api/heartbeat-runs/:runId/issues returns issue data for a heartbeat run with zero authentication. Every other endpoint in server/src/routes/activity.ts calls assertCompanyAccess, but this one was missed. If an attacker obtains a valid run UUID (from logs, error messages, shared URLs, or by probing), they can read issue data without any credentials. 2. Unauthenticated CLI auth challenge creation POST /api/cli-auth/challenges creates a CLI authentication challenge with no actor check at all. The handler at server/src/routes/access.ts:1638-1659 skips any auth verification. The response includes a boardApiToken that becomes active once the…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary code execution vulnerability in the workspace runtime service allows any agent to execute shell commands on the server, exposing all environment variables including API keys, JWT secrets, and database credentials. Details A malicious skill can instruct the agent to exploit the workspace runtime service feature, which allows arbitrary shell command execution on the server. Vulnerable Code Path 1. Agent calls PATCH /api/projects/{projectId}/workspaces/{workspaceId} to set a malicious runtimeConfig 2. Agent calls POST /api/projects/{projectId}/workspaces/{workspaceId}/runtime-services/start 3. Server executes the command via spawn() in server/src/services/workspace-runtime.ts: The command parameter comes directly from workspace config with no sanitization, allowing arbitrary code execution in the server's process context. Attack Flow The attached skill (disguised as a "system health diagnostic") instructs the agent to: 1. Create a workspace with a malicious runtime…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using: As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. Details Rootcause Agent…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target's address. The entire chain is six API calls. I verified every step against the latest version. I have a fully automated PoC script and a video recording available. Discord: sagi03581 Steps to Reproduce The attack chains four independent flaws to escalate from zero access to RCE: Step 1: Create an account (no invite, no email verification) Returns a valid account immediately. No invite token required, no email verification. This works because PAPERCLIPAUTHDISABLESIGNUP defaults to false in server/src/config.ts:169-173: And email verification is hardcoded off in server/src/auth/better-auth.ts:89-93: The environment variable isn't documented in the deployment guide, so operators don't know it exists. Step 2: Sign in Capture the session cookie from the…
Recommended action: Upgrade to 2026.410.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.