---
id: "CVE-2026-119713"
kind: "vulnerability"
aliases: ["CVE-2026-119713"]
title: "Paperclip: agent API key holders can run shell commands on the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "paperclip", "self-hosted"]
not_affected_if: ["fixed-version", "no-untrusted-agent-keys"]
published_at: "2026-10-30T16:17:54+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:31:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119713", "first_seen_at": "2026-10-30T16:31:26+00:00"}]
---

# Paperclip: agent API key holders can run shell commands on the server

Paperclip 2026.403.0 before 2026.416.0 lets anyone holding an agent API key set cleanup and teardown commands on an execution workspace through its PATCH endpoint. When the workspace is archived, the server runs those commands through a shell as the Paperclip server process, so an attacker can execute arbitrary OS commands on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Paperclip version against the affected range `2026.403.0` to `2026.416.0`
- Review whether any agent API keys are issued to untrusted users or processes

## Fix

- Paperclip: move to `2026.416.0` or later

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119713

## From the sources

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_