Remote Code Execution Vulnerability in Paperclip by Paperclip AI

CVE-2026-41679

What is CVE-2026-41679?

A critical vulnerability exists in Paperclip, a Node.js server and React UI designed to manage AI agents for business operations. Before the release of version 2026.416.0, an unauthenticated attacker could exploit this flaw to achieve full remote code execution on any Paperclip instance operating in 'authenticated' mode with default settings. The attack is highly automated, requiring no user interaction or authentication, and takes advantage of a sequence of six specific API calls. Users are urged to update to the latest version to mitigate these security risks. For further details, please refer to the security advisory.

References