Read the docs

paperclipai

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

paperclipai records in CISA KEV

No paperclipai vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-53840 CVE-2026-77087 · GHSA-gwmj-hf32-5v8v

Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

Priority HIGH 76

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00486 Published 2026-08-21 Fixed in 0.3.1 CWE-862
TI-2026-83188 CVE-2026-119713 · GHSA-832j-x75x-r6jc

Command injection in Paperclip server lets API key holders run OS commands

Priority MEDIUM 41

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00798 Published 2026-10-30 Fixed in 2026.416.0 CWE-78
Open these records in search →