Is CVE-2026-41208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41208 being exploited in the wild.

How severe is CVE-2026-41208?

High severity, with a CVSS score of 8.8, published 23 April 2026.

Which products and versions are affected?

@paperclipai/server (npm) < 2026.416.0, SEMVER:introduced=0,fixed=2026.416.0.

Is there a fix for CVE-2026-41208?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41208 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-41208?

Check whether you run @paperclipai/server (npm) or Paperclipai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41208: Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Q: Is there a fix for CVE-2026-41208?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41208 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-41208?

Check whether you run @paperclipai/server (npm) or Paperclipai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41208 · Severity: high · CVSS 8.8 · Published 2026-04-23

Paperclip is an open-source application for managing AI agents. The vulnerability allows an attacker with a valid agent credential to execute arbitrary system commands on the Paperclip server by modifying agent configuration settings. Since agent credentials are designed for automation and are commonly shared with external runtimes and third-party providers, this could allow malicious actors to gain complete control over the server, steal secrets and database credentials, or launch further attacks on connected repositories and infrastructure.

Technologies: @paperclipai/server (npm). Vendors: npm, Paperclip.

Quick answers

Is CVE-2026-41208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41208 being exploited in the wild.
How severe is CVE-2026-41208?: High severity, with a CVSS score of 8.8, published 23 April 2026.
Which products and versions are affected?: @paperclipai/server (npm) < 2026.416.0, SEMVER:introduced=0,fixed=2026.416.0.
Is there a fix for CVE-2026-41208?: Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41208 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-41208?: Check whether you run @paperclipai/server (npm) or Paperclipai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/server (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/server@2026.416.0
```

Technical details

The vulnerability is a privilege escalation and remote code execution flaw caused by insufficient input validation and insecure command execution. The root cause lies in the PATCH /api/agents/:id endpoint, which allows agents to modify their own adapterConfig using a permissive validation schema (z.record(z.unknown())). The vulnerable code path in server/src/services/workspace-runtime.ts extracts adapterConfig.workspaceStrategy.provisionCommand and passes it directly to spawn("/bin/sh", ["-c", command]) without any validation, escaping, or allowlist. An attacker with an Agent API key can inject arbitrary shell commands into the provisionCommand field, which are then executed with server privileges during workspace provisioning. The attack vector is network-based and requires only agent API credentials; no administrator access is needed. Successful exploitation enables arbitrary OS command execution, allowing attackers to read environment variables, exfiltrate secrets, modify repositories, access database credentials, and establish reverse shells. Patches are available in version 2026.416.0 and later.

Affected products

Paperclip Paperclip <= v0.3.1

Identifiers

CVE-2026-41208
GHSA-265w-rf2w-cjh4

Timeline

2026-04-16: disclosed
2026-04-16: patched: Patch version 2026.416.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.