Paperclip versions older than 2026.416.0 expose a privilege‑escalation flaw that allows an attacker possessing an Agent API key to insert and execute arbitrary shell commands on the server host. The flaw originates from an agent’s ability to modify its own adapterConfig via the /agents/:id endpoint, specifically the workspaceStrategy.provisionCommand field, which the server later evaluates during workspace provisioning. This breach of the intended trust boundary turns a normally isolated agent runtime into a full‑blown vector for remote code execution on the host operating system, compromising confidentiality, integrity and availability of the entire infrastructure. CWE‑78 describes this type of command injection vulnerability.

The vulnerability affects Paperclip’s Node.js server component, identified as @paperclipai/server. All releases prior to 2026.416.0 are impacted. The flaw has been mitigated in @paperclipai/server 2026.416.0 and later updates.

The issue is scored with a CVSS of 8.8, indicating high severity, while the EPSS score is below 1 %, reflecting a low but non‑zero likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess a valid agent credential and can leverage the exposed endpoint to inject commands, resulting in remote code execution. No additional exploitation prerequisites beyond normal agent access are required, so the attack vector is effectively external via the public API.