{"schema_version":1,"title":"Paperclip vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 5 vulnerabilities in Paperclip: 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77087, was published on 21 August 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/vendors/paperclip","json_url":"https://junglewise.ai/threats/vendors/paperclip.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/paperclip","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":1,"all_time":5,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":5},"latest":[{"cve":"CVE-2026-77087","cvss":9.6,"epss":0.0057,"slug":"cve-2026-77087-paperclip-dns-rebinding-remote-code-execution","title":"Paperclip DNS rebinding remote code execution","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:47.29+00:00","url":"https://junglewise.ai/threats/cve-2026-77087-paperclip-dns-rebinding-remote-code-execution"},{"cve":"CVE-2026-41679","cvss":10,"epss":0.3167,"slug":"cve-2026-41679-paperclip-vulnerable-to-unauthenticated-remote-code-execution-via","title":"paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass","severity":"critical","exploited":false,"published_at":"2026-04-23T02:16:19.18+00:00","url":"https://junglewise.ai/threats/cve-2026-41679-paperclip-vulnerable-to-unauthenticated-remote-code-execution-via"},{"cve":"CVE-2026-41208","cvss":8.8,"epss":0.0059,"slug":"cve-2026-41208-paperclip-privilege-escalation-via-agent-controlled","title":"Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution","severity":"high","exploited":false,"published_at":"2026-04-23T02:16:18.67+00:00","url":"https://junglewise.ai/threats/cve-2026-41208-paperclip-privilege-escalation-via-agent-controlled"},{"cvss":3.1,"slug":"paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b","title":"Paperclip approval decision attribution spoofing via client-controlled decidedByUserId","severity":"low","exploited":false,"published_at":"2026-04-16T22:48:46+00:00","url":"https://junglewise.ai/threats/paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b"},{"cvss":3.1,"slug":"paperclip-arbitrary-code-execution-in-workspace-runtime-service-d872f5d0","title":"Paperclip arbitrary code execution in workspace runtime service","severity":"low","exploited":false,"published_at":"2026-04-16T22:46:52+00:00","url":"https://junglewise.ai/threats/paperclip-arbitrary-code-execution-in-workspace-runtime-service-d872f5d0"}],"vendor":{"hub":true,"name":"Paperclip","slug":"paperclip","description":"Paperclip is a Ruby gem for handling file attachments in web applications.","url":"https://junglewise.ai/threats/vendors/paperclip"},"weekly":[{"week":"2026-08-17","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-41679","cvss":10,"epss":0.3167,"slug":"cve-2026-41679-paperclip-vulnerable-to-unauthenticated-remote-code-execution-via","title":"paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass","severity":"critical","exploited":false,"published_at":"2026-04-23T02:16:19.18+00:00","url":"https://junglewise.ai/threats/cve-2026-41679-paperclip-vulnerable-to-unauthenticated-remote-code-execution-via"},{"cve":"CVE-2026-77087","cvss":9.6,"epss":0.0057,"slug":"cve-2026-77087-paperclip-dns-rebinding-remote-code-execution","title":"Paperclip DNS rebinding remote code execution","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:47.29+00:00","url":"https://junglewise.ai/threats/cve-2026-77087-paperclip-dns-rebinding-remote-code-execution"},{"cve":"CVE-2026-41208","cvss":8.8,"epss":0.0059,"slug":"cve-2026-41208-paperclip-privilege-escalation-via-agent-controlled","title":"Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution","severity":"high","exploited":false,"published_at":"2026-04-23T02:16:18.67+00:00","url":"https://junglewise.ai/threats/cve-2026-41208-paperclip-privilege-escalation-via-agent-controlled"},{"cvss":3.1,"slug":"paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b","title":"Paperclip approval decision attribution spoofing via client-controlled decidedByUserId","severity":"low","exploited":false,"published_at":"2026-04-16T22:48:46+00:00","url":"https://junglewise.ai/threats/paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b"},{"cvss":3.1,"slug":"paperclip-arbitrary-code-execution-in-workspace-runtime-service-d872f5d0","title":"Paperclip arbitrary code execution in workspace runtime service","severity":"low","exploited":false,"published_at":"2026-04-16T22:46:52+00:00","url":"https://junglewise.ai/threats/paperclip-arbitrary-code-execution-in-workspace-runtime-service-d872f5d0"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[]}