CVE-2026-41679
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business.
Published Apr 23, 2026 · updated Jun 17, 2026 · paperclip paperclipai
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 23, 2026 · NIST NVD
Detected
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is
Jun 17, 2026 · NIST NVD
Updated
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is
Affected
- cpe paperclip/paperclipaiversion unspecified
- cpe paperclip/paperclipai/serverversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41679
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41679
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in mode with de
nvd.nist.gov