SB2026080744 - Multiple vulnerabilities in Paperclip

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080744

SB2026080744 - Multiple vulnerabilities in Paperclip

Published: August 7, 2026 Updated: August 8, 2026

Security Bulletin ID SB2026080744
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 18% Medium 45% Low 36%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-41679) Exploited

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper access control in the import authorization mechanism when handling import requests. A remote attacker can bypass authorization and submit a crafted import request to execute arbitrary code.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and send email from a connected Gmail account.

The vulnerability exists due to improper access control in the Paperclip-managed codex_local runtime when accessing inherited OpenAI app connectors. A remote user can execute tasks that invoke Gmail connector actions to disclose sensitive information and send email from a connected Gmail account.

User interaction is required to connect Gmail in the ChatGPT/OpenAI apps UI before exploitation.


3) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in the Execution Workspace lifecycle cleanupCommand handling in workspace-runtime.ts when processing a crafted PATCH request to /api/execution-workspaces/:id and later archiving the workspace. A remote attacker can inject a crafted cleanupCommand value to execute arbitrary code.

In the default local_trusted deployment mode, no authentication is required, and exploitation occurs when the workspace cleanup routine invokes the supplied command through a shell.


4) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass cross-tenant authorization and mint an agent API token to gain unauthorized access to another company's data and agent operations.

The vulnerability exists due to improper authorization in the /api/agents/:id/keys, /api/agents/:id/keys/:keyId, and related agent lifecycle handlers when handling requests for agent key management and agent actions without verifying company membership. A remote user can send a specially crafted request targeting an agent ID in another company to bypass cross-tenant authorization and mint an agent API token to gain unauthorized access to another company's data and agent operations.

Exploitation requires the application to run in authenticated mode, and user interaction is not required.


5) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof approval decision attribution.

The vulnerability exists due to insufficient verification of data authenticity in the approval-resolution endpoints when processing a client-supplied decidedByUserId field. A remote user can send a specially crafted request with another user's identifier to spoof approval decision attribution.

For hire_agent approvals with a monthly budget, the forged identifier is also written into budget_policies audit columns. In multi-user authenticated deployments, any board member with access to the approval's company can exploit this issue.


6) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the victim's browser session.

The vulnerability exists due to cross-site scripting in MarkdownBody when rendering markdown links with unsanitized javascript: URLs. A remote user can store a crafted markdown link and trick the victim into clicking it to execute arbitrary script in the victim's browser session.

User interaction is required to click the crafted link, and the issue affects markdown-rendered documents, comments, chat threads, approvals, agent details, export previews, and other markdown surfaces.


7) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to compromise another tenant, disclose sensitive information, modify data, and cause a denial of service.

The vulnerability exists due to improper access control in the `/agents/:id/keys` routes when handling key management requests for attacker-supplied agent or key identifiers. A remote user can send crafted `GET`, `POST`, or `DELETE` requests to list, create, or revoke agent API keys across tenant boundaries to compromise another tenant, disclose sensitive information, modify data, and cause a denial of service.

The `POST` handler returns a cleartext agent token for the victim company, and the `DELETE` path authorizes by `keyId` without validating that the key belongs to a company accessible to the caller.


8) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and perform unauthorized state-changing operations.

The vulnerability exists due to missing authentication for critical functions in multiple API endpoints when handling requests in authenticated mode. A remote user can send crafted requests to access sensitive data and invoke exposed API functionality without authentication checks.

Exposed endpoints include heartbeat run issue retrieval, CLI authentication challenge creation, skill endpoint access, and deployment configuration disclosure.


9) Command injection (CVE-ID: N/A)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to command injection in the workspace runtime service when processing workspace runtime configuration and starting runtime services. A remote user can supply a malicious runtime command through the workspace configuration and trigger the runtime service to start to execute arbitrary code.

User interaction is required to import or load a malicious skill.


10) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to external control of file name or path in the execute() function in packages/adapters/claude-local/src/server/execute.ts when processing agent execution with an attacker-controlled adapterConfig.instructionsFilePath value. A remote user can modify agent configuration through the /api/agents/:id endpoint and trigger agent execution to disclose sensitive information.

The issue affects agent credentials that can modify their own adapterConfig, and the server reads the supplied path with fs.readFile() from the host filesystem.


11) OS Command Injection (CVE-ID: CVE-2026-41208)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary OS commands on the server host.

The vulnerability exists due to command injection in the workspace provisioning command handling in server/src/services/workspace-runtime.ts when processing agent-controlled adapterConfig.workspaceStrategy.provisionCommand during workspace provisioning. A remote user can update agent configuration and trigger workspace provisioning to execute arbitrary OS commands on the server host.

Exploitation requires an Agent API key and can be triggered through the PATCH /api/agents/:id and POST /api/agents/:id/wakeup API endpoints.


Remediation

Install update from vendor's website.

References