@paperclipai/server 2026.404.0-canary.3

Direct Vulnerabilities

Known vulnerabilities in the @paperclipai/server package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Improper Verification of Source of a Communication Channel Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel through the `local_trusted` authentication middleware in `server/src/middleware/auth.ts` and the `process` adapter in `server/src/adapters/process/execute.ts`. An attacker can execute arbitrary commands on the victim’s machine by luring a user to open a malicious webpage that makes browser requests rebound from the attacker’s server to the local Paperclip instance. In the default local deployment, every request is treated as instance admin, so the attacker can call Paperclip’s API without credentials and trigger a company import that configures a process-based agent. When the agent is woken up, Paperclip spawns the attacker-controlled command as the OS user running the server, giving the attacker access to local files, secrets, and the ability to install backdoors. How to fix Improper Verification of Source of a Communication Channel? There is no fixed version for `@paperclipai/server`.	*
C Command Injection Affected versions of this package are vulnerable to Command Injection via the `cleanupCommand` field in the PATCH `/api/execution-workspaces/:id` endpoint, which is stored and later executed by the server without input validation or sanitization. An attacker can execute arbitrary system commands with the privileges of the server process by supplying crafted input to this field, potentially leading to full system compromise, data exfiltration, or lateral movement within the environment. Note: This is only exploitable if the deployment is in `local_trusted` mode (default for desktop installations, requiring zero authentication) or if any authenticated user has access in `authenticated` mode. How to fix Command Injection? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
H Missing Authentication for Critical Function Affected versions of this package are vulnerable to Missing Authentication for Critical Function in several API endpoints that lack proper authentication checks. An attacker can access sensitive data, perform state-changing operations, and obtain internal configuration details by sending unauthenticated requests to exposed endpoints. How to fix Missing Authentication for Critical Function? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
H Insufficient Granularity of Access Control Affected versions of this package are vulnerable to Insufficient Granularity of Access Control inadequate authorization checks in the `POST /api/agents/:id/keys`, `GET /api/agents/:id/keys`, and `DELETE /api/agents/:id/keys/:keyId` routes. An attacker can gain unauthorized access to sensitive data and perform privileged actions across tenant boundaries by minting agent API tokens for agents belonging to other companies, then using those tokens to access or modify resources in the victim tenant. Note: This is only exploitable if the application is running in authenticated mode with open signup enabled and at least one other company with agents exists on the instance. How to fix Insufficient Granularity of Access Control? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
H Arbitrary Command Injection Affected versions of this package are vulnerable to Arbitrary Command Injection via the `spawn` function. An attacker can execute arbitrary shell commands on the server and access sensitive environment variables, including API keys, authentication secrets, and database credentials, by submitting a malicious configuration that is processed without proper sanitization. How to fix Arbitrary Command Injection? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
M Insufficient Verification of Data Authenticity Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `decidedByUserId` field in approval-related endpoints. An attacker can forge decision attribution by supplying an arbitrary user identifier in the request body, causing the system to record actions as if performed by another legitimate user. This can undermine the integrity of governance and audit trails, allowing a user to falsely attribute approval, rejection, or revision requests to others. Note: This is only exploitable if the attacker is an authenticated board user with access to the target company. How to fix Insufficient Verification of Data Authenticity? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
M External Control of File Name or Path Affected versions of this package are vulnerable to External Control of File Name or Path via the `adapterConfig.instructionsFilePath` configuration field, which is processed by the server during agent execution. An attacker can access sensitive files on the host filesystem by supplying arbitrary file paths through the agent configuration API endpoint using a valid Agent API key. How to fix External Control of File Name or Path? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `MarkdownBody` class, where user-supplied markdown content is rendered without proper URL sanitization due to an overridden `urlTransform` function. An attacker can execute arbitrary JavaScript in the context of another user's session by embedding malicious `javascript:` URLs in markdown links, which are rendered and executed when clicked by a victim. How to fix Cross-site Scripting (XSS)? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
H Command Injection Affected versions of this package are vulnerable to Command Injection via the `/agents/:id` update endpoint and `adapterConfig.workspaceStrategy.provisionCommand`. An attacker can execute arbitrary OS commands by updating their agent’s configuration with a crafted `provisionCommand`, which is later executed by the server using spawn(`"/bin/sh"`, `["-c", command]`) during workspace provisioning, allowing escalation from the agent runtime to the server host. How to fix Command Injection? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0
H Missing Authorization Affected versions of this package are vulnerable to Missing Authorization via import flow. An attacker can gain remote code execution using company creation endpoint that improperly checks for admin rights in `authenticated` mode deployment with default configuration. How to fix Missing Authorization? Upgrade `@paperclipai/server` to version 2026.416.0 or higher.	<2026.416.0

Vulnerability

Vulnerable Version

Improper Verification of Source of a Communication Channel

Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel through the local_trusted authentication middleware in server/src/middleware/auth.ts and the process adapter in server/src/adapters/process/execute.ts. An attacker can execute arbitrary commands on the victim’s machine by luring a user to open a malicious webpage that makes browser requests rebound from the attacker’s server to the local Paperclip instance. In the default local deployment, every request is treated as instance admin, so the attacker can call Paperclip’s API without credentials and trigger a company import that configures a process-based agent. When the agent is woken up, Paperclip spawns the attacker-controlled command as the OS user running the server, giving the attacker access to local files, secrets, and the ability to install backdoors.

How to fix Improper Verification of Source of a Communication Channel?

There is no fixed version for @paperclipai/server.

Command Injection

Affected versions of this package are vulnerable to Command Injection via the cleanupCommand field in the PATCH /api/execution-workspaces/:id endpoint, which is stored and later executed by the server without input validation or sanitization. An attacker can execute arbitrary system commands with the privileges of the server process by supplying crafted input to this field, potentially leading to full system compromise, data exfiltration, or lateral movement within the environment.

Note: This is only exploitable if the deployment is in local_trusted mode (default for desktop installations, requiring zero authentication) or if any authenticated user has access in authenticated mode.

How to fix Command Injection?