CriticalVulnerability
CVE-2026-41679: Paperclip unauthenticated remote code execution through its API
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-41679
- Published
- Record updated
- Affected
- paperclipai < 2026.410.0
- @paperclipai/server < 2026.410.0
- Fixed in
- 2026.410.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 31.7%
Summary
Paperclip, a Node.js server and React UI for orchestrating AI agents, is affected by CVE-2026-41679 in versions prior to 2026.416.0. An unauthenticated attacker can achieve full remote code execution on any network-accessible instance running in `authenticated` mode with default configuration, using a six-call API chain requiring no credentials or user interaction.
Mitigation
Version 2026.416.0 patches the issue.
Topics
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News