Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 16 April 2026.

Which products and versions are affected?

@paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0.

Is there a fix for This vulnerability?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run @paperclipai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Paperclip arbitrary code execution in workspace runtime service

Severity: low · CVSS 3.1 · Published 2026-04-16

Paperclip is an AI agent platform that allows users to create custom skills (plugins) to extend agent capabilities. A critical vulnerability allows malicious skills to execute arbitrary shell commands on the Paperclip server, exposing all sensitive environment variables including API keys, database credentials, and authentication secrets. An attacker who can install or trick an agent into loading a malicious skill can compromise the entire server and access customer data.

Technologies: @paperclipai/server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 16 April 2026.
Which products and versions are affected?: @paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0.
Is there a fix for This vulnerability?: Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run @paperclipai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/server (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/server@2026.416.0
```

Technical details

This is an arbitrary code execution (ACE) vulnerability in the workspace runtime service. The root cause is in server/src/services/workspace-runtime.ts, where the `spawn()` function executes shell commands from the runtimeConfig parameter with no input sanitization. An attacker can call PATCH /api/projects/{projectId}/workspaces/{workspaceId} to set a malicious runtimeConfig, then trigger command execution via POST /api/projects/{projectId}/workspaces/{workspaceId}/runtime-services/start. The attack precondition is that an agent must load or a user must install the malicious skill; no authentication bypass is required if the agent is already compromised. The demonstrated impact includes exfiltration of OPENAI_API_KEY, database credentials, JWT secrets, and full server compromise. A patch is available in version 2026.416.0.

Affected products

Paperclip Paperclip <2026.416.0

Timeline

2026-04-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.