Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 | Third Party Advisory Exploit Mitigation |
| https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 | Third Party Advisory Exploit Mitigation |
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 14:58
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Paperclip paperclipai
Paperclip paperclipai\/server Paperclip |
|
| References | () https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 - Third Party Advisory, Exploit, Mitigation | |
| CPE | cpe:2.3:a:paperclip:paperclipai\/server:*:*:*:*:*:node.js:*:* cpe:2.3:a:paperclip:paperclipai:*:*:*:*:*:node.js:*:* |
23 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 - |
23 Apr 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-23 02:16
Updated : 2026-04-27 14:58
NVD link : CVE-2026-41679
Mitre link : CVE-2026-41679
CVE.ORG link : CVE-2026-41679
JSON object : View
Products Affected
paperclip
- paperclipai
- paperclipai\/server