Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 16 April 2026.

Which products and versions are affected?

@paperclipai/shared (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <= v0.3.1.

Is there a fix for This vulnerability?

Yes. @paperclipai/shared (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @paperclipai/shared (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Paperclip arbitrary file read via agent-controlled instructionsFilePath

Q: Is there a fix for This vulnerability?

Yes. @paperclipai/shared (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run @paperclipai/shared (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2026-04-16

Paperclip is an open-source application for managing AI agents in corporate environments. The vulnerability allows an authenticated attacker with an Agent API key to read arbitrary files from the server's filesystem by injecting a malicious file path into agent configuration. An attacker could potentially access sensitive data such as environment files, SSH keys, database credentials, and API tokens, leading to broader compromise of the deployment environment.

Technologies: Paperclip AI Paperclip. Vendors: npm, Paperclip AI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 16 April 2026.
Which products and versions are affected?: @paperclipai/shared (npm) SEMVER:introduced=0,fixed=2026.416.0; Paperclip AI Paperclip <= v0.3.1.
Is there a fix for This vulnerability?: Yes. @paperclipai/shared (npm): upgrade to 2026.416.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @paperclipai/shared (npm) or Paperclip AI Paperclip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@paperclipai/shared (npm): upgrade to 2026.416.0 or later
```
npm install @paperclipai/shared@2026.416.0
```

Technical details

The vulnerability is a classic path traversal / arbitrary file read issue (CWE-73) in Paperclip's agent adapter configuration handling. The root cause is in packages/adapters/claude-local/src/server/execute.ts, where the code reads instructionsFilePath from attacker-controlled agent configuration via fs.readFile() without path normalization, allowlist validation, or workspace boundary checks. The vulnerable schema (packages/shared/src/validators/agent.ts) permits arbitrary fields inside adapterConfig via z.record(z.unknown()). An authenticated agent can exploit this by: (1) calling PATCH /api/agents/{id} to inject adapterConfig.instructionsFilePath with an absolute path, then (2) triggering agent execution via POST /api/agents/{id}/wakeup, causing the server to attempt reading the attacker-specified file. No administrator privileges are required—only a valid Agent API key. The patch version 2026.416.0 reportedly addresses this issue; affected versions are ≤ v0.3.1.

Affected products

paperclipai paperclip <= v0.3.1

Timeline

2026-04-16: disclosed
2026-04-16: patched: Patched in version 2026.416.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.