Executive brief
Paperclip is an AI-powered issue tracking and collaboration platform used by teams to manage project work and approvals. The MarkdownBody component—which renders markdown in issue documents, comments, chat threads, and other surfaces throughout the application—fails to sanitize javascript: URLs in links. An authenticated attacker can embed malicious JavaScript in markdown content; when a colleague clicks the link, the script executes with full access to that victim's session, enabling account takeover and data theft within the company tenant.
Technical details
The vulnerability is stored cross-site scripting (XSS) caused by disabling react-markdown's built-in URL sanitization. The MarkdownBody component overrides react-markdown's defaultUrlTransform with a no-op function (urlTransform={(url) => url}), which bypasses the library's protection against javascript:, vbscript:, and data: URL schemes. The custom anchor renderer then renders the unsanitized href directly into the DOM. Any authenticated company member can inject [text](javascript:...) into issue documents or comments via the upsertIssueDocument API endpoint (server/src/routes/issues.ts), which stores the markdown body without content validation. When a victim views the issue, IssueDocumentsSection renders the body through MarkdownBody, emitting the dangerous href. Clicking the link executes the attacker's script in the Paperclip origin with the victim's session cookies. Authorization checks (assertCompanyAccess) do not prevent lower-privilege users from targeting admins and owners. No Content-Security-Policy header protects the main application, allowing browser navigation of javascript: schemes.
Affected products
- Paperclip AI Paperclip <= 2026.410.0-canary.1
Timeline
- 2026-04-16: disclosed: GHSA-fpw4-p57j-hqmq published