Executive brief
Paperclip is an AI workspace orchestration platform used for managing code execution environments. An unauthenticated attacker can inject arbitrary shell commands through the workspace cleanup configuration, leading to complete server compromise. In the default local_trusted deployment mode (common for desktop installations), this requires zero authentication; in authenticated deployments, any company user can exploit it.
Technical details
This is an OS command injection vulnerability (CWE-78) in the execution workspace lifecycle. The vulnerable code path is in workspace-runtime.ts, where the cleanupExecutionWorkspaceArtifacts() function passes user-supplied cleanupCommand values directly to child_process.spawn() without any input validation, sanitization, or allowlisting. An attacker can inject arbitrary shell commands via the PATCH /api/execution-workspaces/:id endpoint, which stores the malicious command in workspace metadata. When the workspace transitions to archived status, the injected command executes with server process privileges. In local_trusted mode (default for desktop), the authentication middleware grants implicit admin privileges to all requests; in authenticated mode, any user with company access can modify workspace config. The vulnerability has been demonstrated with arbitrary file writes, system information exfiltration, and GUI application execution.
Affected products
- Paperclip AI Paperclip <2026.416.0
Timeline
- 2026-04-16: disclosed: GHSA-vr7g-88fq-vhq3 published
- 2026-04-16: patched: Version 2026.416.0 released with fix