Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 16 April 2026.

Which products and versions are affected?

@paperclipai/ui (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <= 2026.410.0-canary.1.

Is there a fix for This vulnerability?

Yes. @paperclipai/ui (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @paperclipai/ui (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Paperclip stored XSS in MarkdownBody via javascript: URLs

Q: Is there a fix for This vulnerability?

Yes. @paperclipai/ui (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network.

Q: Am I affected?

Check whether you run @paperclipai/ui (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2026-04-16

Paperclip is an AI-powered issue tracking and collaboration platform used by teams to manage project work and approvals. The MarkdownBody component—which renders markdown in issue documents, comments, chat threads, and other surfaces throughout the application—fails to sanitize javascript: URLs in links. An authenticated attacker can embed malicious JavaScript in markdown content; when a colleague clicks the link, the script executes with full access to that victim's session, enabling account takeover and data theft within the company tenant.

Technologies: Paperclip AI Paperclip. Vendors: npm, Paperclip AI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 16 April 2026.
Which products and versions are affected?: @paperclipai/ui (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <= 2026.410.0-canary.1.
Is there a fix for This vulnerability?: Yes. @paperclipai/ui (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @paperclipai/ui (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/ui (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/ui@2026.416.0
```

Technical details

The vulnerability is stored cross-site scripting (XSS) caused by disabling react-markdown's built-in URL sanitization. The MarkdownBody component overrides react-markdown's defaultUrlTransform with a no-op function (urlTransform={(url) => url}), which bypasses the library's protection against javascript:, vbscript:, and data: URL schemes. The custom anchor renderer then renders the unsanitized href directly into the DOM. Any authenticated company member can inject [text](javascript:...) into issue documents or comments via the upsertIssueDocument API endpoint (server/src/routes/issues.ts), which stores the markdown body without content validation. When a victim views the issue, IssueDocumentsSection renders the body through MarkdownBody, emitting the dangerous href. Clicking the link executes the attacker's script in the Paperclip origin with the victim's session cookies. Authorization checks (assertCompanyAccess) do not prevent lower-privilege users from targeting admins and owners. No Content-Security-Policy header protects the main application, allowing browser navigation of javascript: schemes.

Affected products

Paperclip AI Paperclip <= 2026.410.0-canary.1

Timeline

2026-04-16: disclosed: GHSA-fpw4-p57j-hqmq published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.