GHSA-68qg-g8mg-6pr7
Critical · 10.0CVSS
10.0
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @paperclipai/server | 0 | 2026.410.0 |
| npm | paperclipai | 0 | 2026.410.0 |
Related vulnerabilities
- CVE-2026-41679 Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a… Same vulnerability
- CVE-2026-41208 Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a… Also affects @paperclipai/server
- GHSA-3xx2-mqjm-hg9x Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full… Also affects @paperclipai/server
- GHSA-p7mm-r948-4q3q Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId`… Also affects @paperclipai/server
- GHSA-47wq-cj9q-wpmp Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on… Also affects @paperclipai/server
- GHSA-vr7g-88fq-vhq3 Paperclip: OS Command Injection via Execution Workspace cleanupCommand Also affects @paperclipai/server
- GHSA-xfqj-r5qw-8g4j Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode Also affects @paperclipai/server
- GHSA-w8hx-hqjv-vjcq Paperclip: Malicious skills able to exfiltrate and destroy all user data Also affects @paperclipai/server