Executive brief
Paperclip AI, a platform for managing execution workspaces and source code, contains a critical flaw that allows attackers to run arbitrary commands on the server. By modifying a workspace's cleanup settings, an attacker can force the server to execute malicious code when a workspace is archived. This can lead to full system takeover, theft of sensitive company data, and the insertion of backdoors into software repositories.
Technical details
An OS command injection vulnerability exists in the `cleanupExecutionWorkspaceArtifacts` function within `workspace-runtime.ts`. The application fails to validate or sanitize the `cleanupCommand` configuration field provided via the `PATCH /api/execution-workspaces/:id` endpoint. When a workspace status is updated to 'archived', the server executes the stored command using `child_process.spawn(shell, ["-c", command])`. In the default `local_trusted` deployment mode, this can be exploited without authentication. In `authenticated` mode, any user with company access can trigger the injection due to insufficient authorization checks on workspace configuration updates. A patch is available in version 2026.416.0.
Affected products
- Paperclip AI Paperclip AI < 2026.416.0
Timeline
- 2026-04-13: disclosed: Vulnerability discovered/reported.
- 2026-04-16: advisory: GitHub Advisory GHSA-vr7g-88fq-vhq3 published.
- 2026-04-16: patched: Fixed in version 2026.416.0.