Paperclipai Paperclip vulnerabilities

CVE-2026-41679 [CRITICAL] CWE-287 CVE-2026-41679: Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the tar

CVE-2026-77087 [CRITICAL] CWE-862 CVE-2026-77087: Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attack Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the proces