CVE-2026-119713
CVE-2026-119713 · Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.
CVSS 8.7 · Alta · EPSS 0,8% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
@paperclipai/server
- Versiones
- ≥ 2026.403.0, < 2026.416.0: Afectada (semver)
Actualiza a 2026.416.0
@paperclipai/server npm
- Intervalos de versiones afectados
- SEMVER: < 2026.416.0
Actualiza a 2026.416.0
Fuentes originales
- https://github.com/paperclipai/paperclip/security/advisories/GHSA-vr7g-88fq-vhq3
- https://github.com/paperclipai/paperclip/commit/32a9165ddf6308f3b46eae0653b6f583e502e538
- https://github.com/paperclipai/paperclip/blob/v2026.403.0/server/src/routes/execution-workspaces.ts
- https://github.com/paperclipai/paperclip/releases/tag/v2026.416.0
- https://github.com/paperclipai/paperclip
- https://www.vulncheck.com/advisories/paperclip-2026.403.0-before-2026.416.0-rce-via-execution-workspace-cleanup-commands
- https://nvd.nist.gov/vuln/detail/CVE-2026-119713