CVE-2026-119713 in Paperclip
Summary
by MITRE • 10/30/2026
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Paperclip versions prior to 2026.416.0 represents a critical remote code execution flaw rooted in improper input validation and unsafe command invocation within the agent API infrastructure. This security defect specifically affects users who possess valid agent API keys, granting them the ability to manipulate workspace configurations through standard HTTP PATCH requests directed at the /api/execution-workspaces/:id endpoint. The core technical failure lies in how the system handles specific configuration fields known as cleanupCommand and teardownCommand during the lifecycle management of execution workspaces. These commands are intended for automated resource cleanup but are processed without sufficient sanitization or restriction, allowing an authenticated attacker to inject arbitrary operating system commands into these parameters.
When a workspace is archived, the Paperclip server initiates a routine process called cleanupExecutionWorkspaceArtifacts. This function is designed to clean up temporary files and resources associated with completed executions. However, due to the vulnerability, this function executes the user-supplied cleanupCommand and teardownCommand values directly through a shell interpreter rather than using safe programmatic execution methods. Because the Paperclip server typically runs with elevated privileges necessary for managing containerized or isolated environments, any command injected by an attacker is executed with the same high-level permissions as the server process itself. This mechanism effectively bypasses isolation boundaries, allowing the attacker to achieve arbitrary code execution on the host machine where the Paperclip service resides.
The operational impact of this vulnerability is severe, as it constitutes a complete compromise of the underlying infrastructure. An authenticated agent API key holder can escalate their privileges from simple workspace management to full control over the server operating system. This capability enables attackers to exfiltrate sensitive data stored on the host, install persistent backdoors, pivot into internal network segments, or disrupt service availability by terminating critical processes. The risk is particularly acute in environments where multiple tenants share a single Paperclip instance, as compromise of one tenant's workspace could lead to lateral movement and access to other workspaces or shared resources. This scenario aligns with the Common Weakness Enumeration CWE-78 improper neutralization of special elements used in an OS command, commonly known as OS Command Injection.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically shell commands such as /bin/sh or cmd.exe depending on the host operating system. The attack vector involves authenticated access via API endpoints, which corresponds to Initial Access techniques involving valid accounts. Furthermore, since the execution occurs during a cleanup phase triggered by workspace archiving, it may evade standard monitoring tools that focus primarily on active user interactions rather than background administrative processes. This makes detection and forensic analysis more challenging for security operations teams relying solely on application-level logs without deep system call inspection.
Mitigation strategies must prioritize immediate patching to version 2026.416.0 or later, where the developers have presumably implemented strict input validation and safe execution practices. In addition to upgrading, organizations should enforce least-privilege principles by ensuring that the Paperclip server process runs with minimal necessary permissions, potentially utilizing containerization or sandboxing techniques to limit the blast radius of any potential command injection. Network segmentation is also recommended to restrict API access to only authorized IP ranges and service accounts. Security teams should audit existing agent API keys for excessive privileges and rotate credentials regularly to minimize the window of opportunity for exploitation if a key is compromised. Continuous monitoring for anomalous shell activity originating from the Paperclip process ID can provide early warning indicators of attempted or successful exploitation in unpatched environments.