Medium, CVSS 6.5npmAmendedPublished
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
GHSA-3pw3-v88x-xj24
- Affected
- npm @paperclipai/shared < 2026.416.0
- Fixed in
- 2026.416.0· Vendor fix available
- Issue
- Paperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem. The vulnerability occurs because agents are allowed to modify their own adapterConfig through the /agents/:id API endpoint. The configuration field adapterConfig.instructionsFilePath is later read directly by the server runtime using fs.readFile(). Because no validation or path restriction is applied, an attacker can supply an arbitrary filesystem path. The Paperclip server then attempts to read that path from the host filesystem during agent execution. This breaks the intended trust boundary between agent runtime configuration and server host filesystem access, allowing a compromised or malicious agent to access sensitive files on the host system. Details Root Cause No path normalization, allowlist, or workspace boundary validation is applied before the filesystem read occurs. Agent configuration can be modified…
Recommended action: Upgrade to 2026.416.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.