npmPackage

@paperclipai/server

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release: 2026.1106.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 2026.1106.0 (Nov 6, 2026), the latest release
Advisories: 3 · 1 critical, 2 high

Weekly downloads: 99.8K
Dependents: 2
Releases: 500+ since 2026.1012.0 (Oct 12, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-119713
No published release is affected
No published release is affected
CVE-2026-41679
No published release is affected
No published release is affected
CVE-2026-41208
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 3

CVE-2026-119713High 8.7
Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
Affected: fixed in 2026.416.0.
Fixed in 2026.416.0.
The latest release, 2026.1106.0, is not affected.
2.9% of @paperclipai/server downloads last week were affected versions (2.1K).
CVE-2026-41679Critical 10.0
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Affected: fixed in 2026.410.0.
Fixed in 2026.410.0.
The latest release, 2026.1106.0, is not affected.
2.7% of @paperclipai/server downloads last week were affected versions (2K).
CVE-2026-41208High 8.8
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
Affected: fixed in 2026.416.0.
Fixed in 2026.416.0.
The latest release, 2026.1106.0, is not affected.
2.9% of @paperclipai/server downloads last week were affected versions (2.1K).