{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/paperclip--0.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-77087"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Paperclip (\u003c 0.3.1)"],"_cs_severities":["critical"],"_cs_tags":["rce","dns-rebinding","developer-tools","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["paperclipai"],"content_html":"\u003cp\u003ePaperclip versions before 0.3.1 contain a critical security vulnerability (CVE-2026-77087) affecting users who run the software in its default 'local_trusted' mode. The vulnerability stems from a failure to validate the Host header during incoming API requests. An attacker can exploit this via DNS rebinding; by tricking a developer into visiting a malicious webpage, the attacker can force the victim's browser to make unauthorized, authenticated API requests to the locally running Paperclip instance. These requests interact with the process adapter, ultimately resulting in remote code execution on the developer's machine. This is a significant risk for development environments where Paperclip is configured to trust local traffic without strict origin verification.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker hosts a malicious website configured to perform DNS rebinding against a target domain that resolves to 127.0.0.1.\u003c/li\u003e\n\u003cli\u003eA developer or user running Paperclip locally navigates to the malicious website in their browser.\u003c/li\u003e\n\u003cli\u003eThe website's scripts initiate a DNS rebinding attack, causing the browser to resolve the attacker-controlled domain to a local address (e.g., localhost).\u003c/li\u003e\n\u003cli\u003eThe browser sends a cross-origin HTTP request to the Paperclip API running on the local host.\u003c/li\u003e\n\u003cli\u003eThe Paperclip application, running in 'local_trusted' mode, fails to perform Host header validation and accepts the forged request.\u003c/li\u003e\n\u003cli\u003eThe request triggers the Paperclip process adapter, which interprets the API command as a legitimate instruction.\u003c/li\u003e\n\u003cli\u003eThe process adapter executes the attacker-supplied command on the developer's local operating system with the privileges of the Paperclip process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary commands on a developer's workstation. This can lead to full system compromise, source code theft, credential exfiltration, and lateral movement into the developer's internal network. Given the CVSS score of 9.6, this vulnerability poses a severe threat to organizations using the affected versions of Paperclip in development environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Paperclip package to version 0.3.1 or higher across all development environments immediately to address CVE-2026-77087.\u003c/li\u003e\n\u003cli\u003eAudit development workstations to identify any active instances of Paperclip running in 'local_trusted' mode.\u003c/li\u003e\n\u003cli\u003eImplement browser-based protections or host-level firewall rules to prevent cross-origin requests from reaching local services on development machines.\u003c/li\u003e\n\u003cli\u003eReview documentation for Paperclip configurations to ensure that 'local_trusted' mode is restricted to secure network segments if it cannot be disabled.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T15:25:14Z","date_published":"2026-08-21T15:25:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-paperclip-dns-rebinding/","summary":"Paperclip versions prior to 0.3.1 are vulnerable to remote code execution due to improper Host header validation when running in 'local_trusted' mode, allowing attackers to leverage DNS rebinding to execute arbitrary commands.","title":"Remote Code Execution in Paperclip via DNS Rebinding","url":"https://feed.craftedsignal.io/briefs/2026-08-paperclip-dns-rebinding/"}],"language":"en","title":"CraftedSignal Threat Feed - Paperclip (\u003c 0.3.1)","version":"https://jsonfeed.org/version/1.1"}