{"id":"CVE-2026-119713","kind":"vulnerability","aliases":["CVE-2026-119713"],"related":[],"title":"Paperclip: agent API key holders can run shell commands on the server","description":"Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.","summary":"Paperclip 2026.403.0 before 2026.416.0 lets anyone holding an agent API key set cleanup and teardown commands on an execution workspace through its PATCH endpoint. When the workspace is archived, the server runs those commands through a shell as the Paperclip server process, so an attacker can execute arbitrary OS commands on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","paperclip","self-hosted"],"not_affected_if":["fixed-version","no-untrusted-agent-keys"],"how_to_check":"- Check the installed Paperclip version against the affected range `2026.403.0` to `2026.416.0`\n- Review whether any agent API keys are issued to untrusted users or processes","fix":"- Paperclip: move to `2026.416.0` or later","status":"open","published_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:31:44+00:00","updated_at":"2026-10-30T16:31:44+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-30T16:31:44Z","model":"claude-haiku-5-5","output":{"fix":"- Paperclip: move to `2026.416.0` or later","reach":"network","title":"Paperclip: agent API key holders can run shell commands on the server","impact":"high","summary":"Paperclip 2026.403.0 before 2026.416.0 lets anyone holding an agent API key set cleanup and teardown commands on an execution workspace through its PATCH endpoint. When the workspace is archived, the server runs those commands through a shell as the Paperclip server process, so an attacker can execute arbitrary OS commands on the host.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["paperclip","self-hosted","ai-agents"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands as the Paperclip server process","analyst_note":"Confirm the fixed version and whether the NVD entry's CVE id is valid; check the Paperclip advisory for any configuration workaround.","how_to_check":"- Check the installed Paperclip version against the affected range `2026.403.0` to `2026.416.0`\n- Review whether any agent API keys are issued to untrusted users or processes\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-agent-keys"],"who_is_affected":"Teams running Paperclip between `2026.403.0` and `2026.416.0` where agent API keys are held by parties who should not control the server. The exposure comes from the PATCH endpoint for execution workspaces and the archive path that runs the stored commands through a shell. Installs on fixed versions, or where no untrusted party holds an agent key, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4174,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119713':15A,18A '-2026':14A,17A '/api/execution-workspaces':105C '2026.403.0':30B,83C '2026.416.0':32B,85C 'agent':2A,21B,37B,94C 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':93C 'anyon':34B 'api':3A,38B,95C 'arbitrari':76B 'archiv':57B,111C 'attack':73B,126C 'attacker-chosen':125C 'chosen':127C 'cleanup':41B 'cleanupcommand':100C 'cleanupexecutionworkspaceartifact':112C 'code':89C 'command':9A,44B,62B,78B,115C,129C 'contain':86C 'cve':13A,16A 'endpoint':52B 'execut':47B,75B,90C,124C 'hold':35B 'holder':5A,97C 'host':28B,81B,133C 'id':106C 'key':4A,39B,96C 'let':33B 'os':77B,128C 'paperclip':1A,25B,29B,68B,82C,121C 'patch':51B,104C 'process':70B,123C 'remot':88C 'run':7A,60B,113C 'self':27B 'self-host':26B 'server':12A,59B,69B,122C,132C 'set':40B,99C 'shell':8A,65B,118C 'teardown':43B 'teardowncommand':102C 'tool':24B 'via':103C 'vulner':91C 'workspac':48B,55B,109C","nicknames":[],"mitigations":[],"who_affected":"Teams running Paperclip between `2026.403.0` and `2026.416.0` where agent API keys are held by parties who should not control the server. The exposure comes from the PATCH endpoint for execution workspaces and the archive path that runs the stored commands through a shell. Installs on fixed versions, or where no untrusted party holds an agent key, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119713","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119713","severity":null,"published_at":"2026-10-30T16:17:54+00:00","modified_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}