HighVulnerabilityLLM-specific
GHSA-gqqj-85qm-8qhf: Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email
- Identifier
- GHSA-gqqj-85qm-8qhf
- Published
- Record updated
- Affected
- paperclipai <= 2026.403.0
- Fixed in
- No fixed version was stated when the source was last read.
Summary
A Paperclip-managed codex_local runtime used a Gmail connector the operator had connected only in the ChatGPT/OpenAI apps UI, without any Gmail connection configured in Paperclip or Codex. The runtime ran gmail_search_emails and gmail_send_email, sending a real outbound email from a personal Gmail account to an external party, followed by retraction messages after manual intervention. The reporter also states that the codex_local default for dangerouslyBypassApprovalsAndSandbox is true, which widens the impact.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
- MediumCVE-2026-100609: Flowise credential lookup by ID bypasses workspace isolationSame vendor · NVD/CVE Database
- MediumCVE-2026-100528: OpenClaw credential exposure to wrong endpoint after model config hot reloadSame vendor · NVD/CVE Database
- MediumCVE-2025-14486: PixelPlay WordPress plugin unauthorized API key deletion via clear_api_typeSame vendor · NVD/CVE Database