Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…erclip/security/advisories/GHSA-vr7g-88fq-vhq3 Üretici bülteni
• github.com/…ommit/32a9165ddf6308f3b46eae0653b6f583e502e538 Yama
• vulncheck.com/…0-rce-via-execution-workspace-cleanup-commands Üçüncü taraf
• github.com/…03.0/server/src/routes/execution-workspaces.ts Diğer
• github.com/paperclipai/paperclip/releases/tag/v2026.416.0 Diğer
• github.com/paperclipai/paperclip Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:16Yayımlandı

İlgili açıklar

• 7,0 CVE-2026-119288Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
• 7,2 CVE-2026-118238CVE-2026-118238
• 8,8 CVE-2026-91913Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in…
• 8,4 CVE-2026-118992CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
• 7,2 CVE-2026-101210Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in…
• 7,2 CVE-2026-101214Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in…