PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-119713 paperclipai CVE debrief

A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint. When the workspace is archived, the server executes this command verbatim via `child_process.spawn(shell, [“-c”, cleanupCommand])` with no input validation or sanitization. In `local_trusted` mode (the default for desktop installations), this requires zero authentication. Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (`systeminfo`), and GUI application launch (`calc.exe`).

Vendor
paperclipai
Product
@paperclipai/server
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-16
Original CVE updated
2026-10-31
Advisory published
2026-04-16
Advisory updated
2026-10-31

Who should care

Defenders responsible for Paperclip AI installations, especially those in `local_trusted` mode, should assess exposure and verify the integrity of their execution workspace configurations.

Why it matters

A critical OS command injection vulnerability in Paperclip AI's execution workspace lifecycle requires immediate attention from defenders to prevent potential exploitation and data breaches.

  • Potential for arbitrary file write, full system information exfiltration, and GUI application launch.
  • Possible exploitation requires zero authentication in `local_trusted` mode.
  • Verification of exposure and configuration integrity is necessary to prevent exploitation.
  • Remediation priority is high due to the critical nature of the vulnerability.

Technical summary

The vulnerability exists in the execution workspace lifecycle of Paperclip AI, specifically in the `workspace-runtime.ts` component. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint, which is executed verbatim by the server with no input validation or sanitization. This requires immediate attention from defenders to prevent potential exploitation and data breaches, especially in `local_trusted` mode, which requires zero authentication. The vulnerability was demonstrated through three independent proofs of exploitation on Windows 11, including arbitrary file write, full system information exfiltration, and GUI application.

Defensive priority

Defenders should prioritize verifying exposure of Paperclip AI v2026.403.0 installations, especially in `local_trusted` mode, and assess the integrity of their execution workspace configurations.

Recommended defensive actions

  • Verify the version of Paperclip AI and upgrade to a fixed version (2026.416.0 or later) if necessary.
  • Assess the configuration of execution workspaces, especially in `local_trusted` mode, to prevent unauthorized access.
  • Implement input validation and sanitization for the `cleanupCommand` field.
  • Monitor for suspicious activity related to the `PATCH /api/execution-workspaces/:id` endpoint.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was demonstrated through three independent proofs of exploitation on Windows 11. The affected software is Paperclip AI v2026.403.0, and the vulnerability exists in the execution workspace lifecycle, specifically in the `workspace-runtime.ts` component.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-119713 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-119713

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-119713 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-119713

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.