# CVE-2026-41208: Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Source: https://junglewise.ai/threats/cve-2026-41208-paperclip-privilege-escalation-via-agent-controlled  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-41208 · Severity: high · CVSS 8.8 · Published 2026-04-23

Paperclip is an open-source application for managing AI agents. The vulnerability allows an attacker with a valid agent credential to execute arbitrary system commands on the Paperclip server by modifying agent configuration settings. Since agent credentials are designed for automation and are commonly shared with external runtimes and third-party providers, this could allow malicious actors to gain complete control over the server, steal secrets and database credentials, or launch further attacks on connected repositories and infrastructure.

Technologies: [@paperclipai/server (npm)](https://junglewise.ai/threats/technologies/paperclipai-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Paperclip](https://junglewise.ai/threats/vendors/paperclip).

## Quick answers

**Is CVE-2026-41208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41208 being exploited in the wild.

**How severe is CVE-2026-41208?** High severity, with a CVSS score of 8.8, published 23 April 2026.

**Which products and versions are affected?** @paperclipai/server (npm) < 2026.416.0, SEMVER:introduced=0,fixed=2026.416.0.

**Is there a fix for CVE-2026-41208?** Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41208 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-41208?** Check whether you run @paperclipai/server (npm) or Paperclipai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @paperclipai/server (npm): upgrade to 2026.416.0 or later

  ```sh
  npm install @paperclipai/server@2026.416.0
  ```


## Technical details

The vulnerability is a privilege escalation and remote code execution flaw caused by insufficient input validation and insecure command execution. The root cause lies in the PATCH /api/agents/:id endpoint, which allows agents to modify their own adapterConfig using a permissive validation schema (z.record(z.unknown())). The vulnerable code path in server/src/services/workspace-runtime.ts extracts adapterConfig.workspaceStrategy.provisionCommand and passes it directly to spawn("/bin/sh", ["-c", command]) without any validation, escaping, or allowlist. An attacker with an Agent API key can inject arbitrary shell commands into the provisionCommand field, which are then executed with server privileges during workspace provisioning. The attack vector is network-based and requires only agent API credentials; no administrator access is needed. Successful exploitation enables arbitrary OS command execution, allowing attackers to read environment variables, exfiltrate secrets, modify repositories, access database credentials, and establish reverse shells. Patches are available in version 2026.416.0 and later.

## Affected products

- Paperclip Paperclip <= v0.3.1

## Identifiers

- CVE-2026-41208
- GHSA-265w-rf2w-cjh4

## Timeline

- 2026-04-16: disclosed
- 2026-04-16: patched: Patch version 2026.416.0 released

## References

- [https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4](https://github.com/paperclipai/paperclip/security/advisories/GHSA-265w-rf2w-cjh4)
- [https://github.com/paperclipai/paperclip](https://github.com/paperclipai/paperclip)

## Related threats

- [paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass](https://junglewise.ai/threats/cve-2026-41679-paperclip-vulnerable-to-unauthenticated-remote-code-execution-via)
- [Paperclip cross-tenant agent API key IDOR in /agents/:id/keys](https://junglewise.ai/threats/paperclip-idor-in-agent-api-key-management-routes-b978dafc)
- [Paperclip approval decision attribution spoofing via client-controlled decidedByUserId](https://junglewise.ai/threats/paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b)
- [Paperclip cross-tenant agent API token minting authorization bypass](https://junglewise.ai/threats/paperclip-cross-tenant-agent-api-token-minting-authorization-bypass-880d0a89)
- [Paperclip OS command injection in execution workspace cleanup](https://junglewise.ai/threats/paperclip-os-command-injection-in-execution-workspace-cleanup-1e244286)