---
title: "GHSA-vr7g-88fq-vhq3: Paperclip: OS Command Injection via Execution Workspace cleanupCommand"
url: https://erroneo.us/security/ghsa/GHSA-vr7g-88fq-vhq3/
description: "GHSA-vr7g-88fq-vhq3 (critical, npm): Paperclip: OS Command Injection via Execution Workspace cleanupCommand. | Field | Value | |-------|-------| | Affected…"
type: advisory
section: "Security Digest"
date_published: 2026-04-16
date_modified: 2026-04-16
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vr7g-88fq-vhq3"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vr7g-88fq-vhq3: Paperclip: OS Command Injection via Execution Workspace cleanupCommand

## Affected packages

- npm `@paperclipai/server` < 2026.416.0 → fixed: 2026.416.0

## Details

| Field | Value | |-------|-------| | Affected Software | Paperclip AI v2026.403.0 | | Affected Component | Execution Workspace lifecycle (workspace-runtime.ts) | | Affected Endpoint | PATCH /api/execution-workspaces/:id | | Deployment Modes | All — localtrusted (zero auth), authenticated (any company user) | | Platforms | Linux, macOS, Windows (with Git installed) | | Date | 2026-04-13 | --- Executive Summary A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the cleanupCommand field via the PATCH /api/execution-workspaces/:id endpoint. When the workspace is archived, the server executes this command verbatim via childprocess.spawn(shell, ["-c", cleanupCommand]) with no input validation or sanitization. In localtrusted mode (the default for desktop installations), this requires zero authentication. Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (systeminfo), and GUI application launch (calc.exe). --- Root Cause Analysis Vulnerable Code Path server/src/services/workspace-runtime.ts (line ~738) The cleanupExecutionWorkspaceArtifacts() function iterates over cleanup commands from workspace config and executes each via shell: Missing Input Validation server/src/routes/execution-workspaces.ts — PATCH handler The PATCH endpoint accepts a config object containing cleanupCommand with no validation: The cleanupCommand value is stored directly in workspace metadata and later passed to spawn() without sanitization, allowlisting, or escaping. Shell Resolution resolveShell() returns process.env.SHELL or falls back to "sh": - Linux/macOS: /bin/sh exists natively — commands execute immediately - Windows: sh.exe is available via Git for Windows (C:\Program Files\Git\bin\sh.exe) — Paperclip requires Git, so sh is present on most installations --- Attack Chain The exploit requires 5 HTTP requests with zero authentication in localtrusted mode: Step 1 — Find a Company Step 2 — Find an Execution Workspace Step 3 — Reactivate Workspace (if archived/failed) Step 4 — Inject cleanupCommand (Command Injection) …

## Sources

- [GitHub Advisory GHSA-vr7g-88fq-vhq3](https://github.com/advisories/GHSA-vr7g-88fq-vhq3)
- [github.com](https://github.com/paperclipai/paperclip/security/advisories/GHSA-vr7g-88fq-vhq3)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vr7g-88fq-vhq3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt