Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Description

Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host.

Recommendation

Update the @paperclipai/server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2026.416.0
• Patched version(s): 2026.416.0

References

• GHSA-265w-rf2w-cjh4
• CVE-2026-41208
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass - CVE-2026-41679
• paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass - paperclipai - CVE-2026-41679
• StudioCMS has Privilege Escalation via Insecure API Token Generation - CVE-2026-30944
• Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration - CVE-2026-45716

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@paperclipai/server