PT-2026-34622 · Paperclipai · @Paperclipai/Server+1

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-41679

NVD

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Fix

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-862

CWE-287

CWE-1188

Related Identifiers

CVE-2026-41679

Affected Products

@Paperclipai/Server

Paperclip

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-41679 · Security Note
• https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 · Note