CVE-2026-41208

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.

Summary

Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using:

spawn("/bin/sh", ["-c", command])

As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host.

Details

Rootcause

Agent configuration can be modified through the API endpoint:

PATCH /api/agents/:id

The validation schema allows arbitrary configuration fields:

adapterConfig: z.record(z.unknown())

This allows attackers to inject arbitrary keys into the adapter configuration object. Later, during workspace provisioning, the server runtime executes a shell command derived directly from this configuration. Relevant code path:

server/src/services/workspace-runtime.ts

adapterConfig.workspaceStrategy.provisionCommand
        ↓
provisionExecutionWorktree()
        ↓
runWorkspaceCommand(...)
        ↓
spawn("/bin/sh", ["-c", input.command])

Example logic:

const provisionCommand = asString(input.strategy.provisionCommand, "").trim()

await runWorkspaceCommand({
  command: provisionCommand
})

Inside runWorkspaceCommand the command is executed using:

spawn(shell, ["-c", input.command])

Because no validation, escaping, or allowlist is applied, attacker-controlled configuration becomes a direct OS command execution primitive.

Affected Files

server/src/services/workspace-runtime.ts

Functions involved:

realizeExecutionWorkspace()
provisionExecutionWorktree()
runWorkspaceCommand()

Attacker Model

Required privileges: Attacker needs:

Agent API key

This credential is intended for agent automation and should not grant host-level execution privileges. Agent credentials may also be exposed to external runtimes, plugins, or third-party agent providers. Allowing such credentials to configure host-executed commands creates a privilege escalation vector. No board or administrator access is required.

Attacker Chain

Complete exploit chain:

Attacker obtains Agent API key
        ↓
PATCH /api/agents/:id
        ↓
Inject adapterConfig.workspaceStrategy.provisionCommand
        ↓
POST /api/agents/:id/wakeup
        ↓
Server executes workspace provisioning
        ↓
workspace-runtime.ts
        ↓
spawn("/bin/sh -c")
        ↓
Arbitrary command execution on server host

Trust Boundary Violation

Paperclip’s architecture assumes the following separation:

Agent runtime
        ↓
Paperclip control plane
        ↓
Server host OS

Agents should only perform workflow automation tasks through the orchestration layer.

However, because agent-controlled configuration is executed directly by the server runtime, the boundary collapses:

Agent configuration
        ↓
Server command execution

This allows an agent to execute commands outside its intended permissions.

Why This Is a Vulnerability (Not Expected Behavior)

The provisionCommand field appears intended for trusted operators configuring workspace strategies. However, the current API design allows agents themselves to modify this configuration. Because agent credentials are designed for automation and may be exposed to agent runtimes, plugins, or external providers,…

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime. As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host. @paperclipai/server version 2026.416.0 fixes the issue.

Summary

Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host. The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint. The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using:

spawn("/bin/sh", ["-c", command])

As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning. This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system. This vulnerability allows remote code execution on the server host.

Details

Rootcause

Agent configuration can be modified through the API endpoint:

PATCH /api/agents/:id

The validation schema allows arbitrary configuration fields:

adapterConfig: z.record(z.unknown())

This allows attackers to inject arbitrary keys into the adapter configuration object. Later, during workspace provisioning, the server runtime executes a shell command derived directly from this configuration. Relevant code path:

server/src/services/workspace-runtime.ts

adapterConfig.workspaceStrategy.provisionCommand
        ↓
provisionExecutionWorktree()
        ↓
runWorkspaceCommand(...)
        ↓
spawn("/bin/sh", ["-c", input.command])

Example logic:

const provisionCommand = asString(input.strategy.provisionCommand, "").trim()

await runWorkspaceCommand({
  command: provisionCommand
})

Inside runWorkspaceCommand the command is executed using:

spawn(shell, ["-c", input.command])

Because no validation, escaping, or allowlist is applied, attacker-controlled configuration becomes a direct OS command execution primitive.

Affected Files

server/src/services/workspace-runtime.ts

Functions involved:

realizeExecutionWorkspace()
provisionExecutionWorktree()
runWorkspaceCommand()

Attacker Model

Required privileges: Attacker needs:

Agent API key

This credential is intended for agent automation and should not grant host-level execution privileges. Agent credentials may also be exposed to external runtimes, plugins, or third-party agent providers. Allowing such credentials to configure host-executed commands creates a privilege escalation vector. No board or administrator access is required.

Attacker Chain

Complete exploit chain:

Attacker obtains Agent API key
        ↓
PATCH /api/agents/:id
        ↓
Inject adapterConfig.workspaceStrategy.provisionCommand
        ↓
POST /api/agents/:id/wakeup
        ↓
Server executes workspace provisioning
        ↓
workspace-runtime.ts
        ↓
spawn("/bin/sh -c")
        ↓
Arbitrary command execution on server host

Trust Boundary Violation

Paperclip’s architecture assumes the following separation:

Agent runtime
        ↓
Paperclip control plane
        ↓
Server host OS

Agents should only perform workflow automation tasks through the orchestration layer.

However, because agent-controlled configuration is executed directly by the server runtime, the boundary collapses:

Agent configuration
        ↓
Server command execution

This allows an agent to execute commands outside its intended permissions.

Why This Is a Vulnerability (Not Expected Behavior)

The provisionCommand field appears intended for trusted operators configuring workspace strategies. However, the current API design allows agents themselves to modify this configuration. Because agent credentials are designed for automation and may be exposed to agent runtimes, plugins, or external providers,…