Security Digest · Critical advisory (no CVE assigned)
GHSA-vr7g-88fq-vhq3: Paperclip: OS Command Injection via Execution Workspace cleanupCommand
| Field | Value | |-------|-------| | Affected Software | Paperclip AI v2026.403.0 | | Affected Component | Execution Workspace lifecycle (workspace-runtime.ts) | | Affected Endpoint | PATCH /api/execution-workspaces/:id | | Deployment Modes | All — localtrusted (zero auth), authenticated (any…
CVSS 9.8 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | @paperclipai/server | < 2026.416.0 | 2026.416.0 |
Details
| Field | Value | |-------|-------| | Affected Software | Paperclip AI v2026.403.0 | | Affected Component | Execution Workspace lifecycle (workspace-runtime.ts) | | Affected Endpoint | PATCH /api/execution-workspaces/:id | | Deployment Modes | All — localtrusted (zero auth), authenticated (any company user) | | Platforms | Linux, macOS, Windows (with Git installed) | | Date | 2026-04-13 |
---
Executive Summary
A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the cleanupCommand field via the PATCH /api/execution-workspaces/:id endpoint. When the workspace is archived, the server executes this command verbatim via childprocess.spawn(shell, ["-c", cleanupCommand]) with no input validation or sanitization. In localtrusted mode (the default for desktop installations), this requires zero authentication.
Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (systeminfo), and GUI application launch (calc.exe).
---
Root Cause Analysis
Vulnerable Code Path
CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-vr7g-88fq-vhq3 github.com
- github.com github.com