SZB-98eaa52f04
EUVD lists remote code execution in Paperclip 2026.403.0 to 2026.416.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- paperclipai
- Product
- @paperclipai/server
- First seen
Summary
The EUVD entry EUVD-2026-114118 (CVSS v3.1 score 8.7) describes a remote code execution flaw in the Paperclip server. According to the entry, holders of agent API keys can set cleanupCommand and teardownCommand through a PATCH request, and those commands run when a workspace is archived.
If you use paperclipai
Upgrade Paperclip to version 2026.416.0 or later
Rotate agent API keys and revoke any that may be exposed
Audit execution workspaces for unexpected cleanup or teardown commands
What the sources say 1
· Mastodon: “Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id.” Source