{"data":{"id":"2c7c8d75-7288-4c3b-a7a7-456ed5c1adac","title":"CVE-2026-41679: Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version…","summary":"Paperclip, a Node.js server and React UI for orchestrating AI agents, is affected by CVE-2026-41679 in versions prior to 2026.416.0. An unauthenticated attacker can achieve full remote code execution on any network-accessible instance running in `authenticated` mode with default configuration, using a six-call API chain requiring no credentials or user interaction.","solution":"Version 2026.416.0 patches the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41679","publishedAt":"2026-04-23T02:16:19.180Z","cveId":"CVE-2026-41679","cweIds":["CWE-287","CWE-862","CWE-1188"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["paperclipai@< 2026.410.0 (fixed: 2026.410.0)","@paperclipai/server@< 2026.410.0 (fixed: 2026.410.0)"],"affectedPackageNames":["paperclipai","@paperclipai/server"],"affectedPackageRefs":["npm:paperclipai","npm:@paperclipai/server"],"affectedVendors":[],"affectedVendorsRaw":["Paperclip"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Paperclip unauthenticated remote code execution through its API","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.3167,"epssCheckedAt":"2026-11-10T06:09:41.675Z","kevDateAdded":null,"advisoryAliases":["GHSA-68qg-g8mg-6pr7"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:19.449Z","patchAvailable":true,"disclosureDate":"2026-04-23T02:16:19.180Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T06:09:55.209Z","capecIds":["CAPEC-114","CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@paperclipai/server","fixedVersion":"2026.410.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-11-06T06:09:55.176Z"},{"ecosystem":"npm","name":"paperclipai","fixedVersion":"2026.410.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-11-06T06:09:55.176Z"}]}}