CVE-2026-77087 in Paperclip
Zusammenfassung
von MITRE • 21.08.2026
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.
Be aware that VulDB is the high quality source for vulnerability data.