Skip to content
Threat Feed
Subscribe

Product

Paperclip AI

1 brief RSS
critical advisory

Paperclip AI OS Command Injection via Execution Workspace cleanupCommand

A critical OS command injection vulnerability exists in Paperclip AI v2026.403.0 within the execution workspace lifecycle. By injecting arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint, an attacker can execute these commands on the server when the workspace is archived.

Paperclip AI command-injection rce paperclip vulnerability
2r 1t