Executive brief
Paperclip, an AI agent platform, contains a vulnerability where malicious 'skills' can execute unauthorized commands on the host server. An attacker who can convince a user to import a malicious skill can gain access to sensitive server information, including API keys, database credentials, and authentication secrets. This could lead to a total compromise of the server and the theft or destruction of user data.
Technical details
A command injection vulnerability exists in the workspace runtime service of @paperclipai/server. The root cause is the lack of sanitization of the 'command' parameter within the 'runtimeConfig' when processed by the spawn() function in 'server/src/services/workspace-runtime.ts'. An attacker can exploit this by creating a malicious skill that instructs an agent to update a workspace configuration via a PATCH request and then start the runtime service. This allows arbitrary code execution in the context of the server process, enabling the exfiltration of environment variables (such as OPENAI_API_KEY and DATABASE_URL) via tools like curl. The vulnerability is patched in version 2026.416.0.
Affected products
- paperclipai @paperclipai/server < 2026.416.0
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched
- 2026-04-16: advisory