Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 16 April 2026.

Which products and versions are affected?

@paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <2026.416.0.

Is there a fix for This vulnerability?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run @paperclipai/server (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Paperclip OS command injection in execution workspace cleanup

Q: Is there a fix for This vulnerability?

Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run @paperclipai/server (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2026-04-16

Paperclip is an AI workspace orchestration platform used for managing code execution environments. An unauthenticated attacker can inject arbitrary shell commands through the workspace cleanup configuration, leading to complete server compromise. In the default local_trusted deployment mode (common for desktop installations), this requires zero authentication; in authenticated deployments, any company user can exploit it.

Technologies: @paperclipai/server (npm), Paperclip AI Paperclip. Vendors: npm, Paperclip AI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 16 April 2026.
Which products and versions are affected?: @paperclipai/server (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <2026.416.0.
Is there a fix for This vulnerability?: Yes. @paperclipai/server (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run @paperclipai/server (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/server (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/server@2026.416.0
```

Technical details

This is an OS command injection vulnerability (CWE-78) in the execution workspace lifecycle. The vulnerable code path is in workspace-runtime.ts, where the cleanupExecutionWorkspaceArtifacts() function passes user-supplied cleanupCommand values directly to child_process.spawn() without any input validation, sanitization, or allowlisting. An attacker can inject arbitrary shell commands via the PATCH /api/execution-workspaces/:id endpoint, which stores the malicious command in workspace metadata. When the workspace transitions to archived status, the injected command executes with server process privileges. In local_trusted mode (default for desktop), the authentication middleware grants implicit admin privileges to all requests; in authenticated mode, any user with company access can modify workspace config. The vulnerability has been demonstrated with arbitrary file writes, system information exfiltration, and GUI application execution.

Affected products

Paperclip AI Paperclip <2026.416.0

Timeline

2026-04-16: disclosed: GHSA-vr7g-88fq-vhq3 published
2026-04-16: patched: Version 2026.416.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.