npm/@paperclipai/server

Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Modified: 5/5/2026

Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise

Modified: 4/16/2026

Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

Modified: 4/16/2026

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Modified: 5/5/2026

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

Modified: 4/16/2026

Paperclip: OS Command Injection via Execution Workspace cleanupCommand

Modified: 4/16/2026

Paperclip: Malicious skills able to exfiltrate and destroy all user data

Modified: 4/16/2026

Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

Modified: 4/16/2026