GHSA-vr7g-88fq-vhq3: Paperclip: OS Command Injection via Execution Workspace cleanupCommand

Summary

Paperclip AI v2026.403.0 contains an OS command injection flaw in the Execution Workspace lifecycle (workspace-runtime.ts). The PATCH /api/execution-workspaces/:id endpoint stores an arbitrary cleanupCommand without validation, and the server later runs it through spawn(shell, ["-c", cleanupCommand]) when the workspace is archived. In local_trusted mode, which is the default for desktop installations, exploitation requires no authentication, and the commands run with the privileges of the Paperclip server process.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
• MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
• MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
• HighCVE-2026-104103: Ludwig archive extraction allows writes outside extraction directorySimilar attack · NVD/CVE Database